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ABSTRACT 


Civilian communities and military installations operate numerous critical 
infrastructure systems to deliver services like power, water, mobility, and 
communications to people and missions. The vulnerability of these systems can be 
measured by considering the robustness of each infrastructure network on its own or by 
considering the interdependencies between different networks. Diverse infrastructure 
network models are available to analyze system vulnerability, yet a standard architecture 
for linking pre-existing models for interdependent analysis does not exist. We develop a 
computational framework to generate combined models that link multiple network-flow 
optimization models together for interdependent analysis. We validate our methods and 
implementation in the Python programming language with well-studied interdependent 
energy networks. We further demonstrate the versatility of our methods by developing a 
new assessment of fictitious energy and transportation networks with models not 
originally created with interdependencies. Overall, this work develops a standard way to 
conduct interdependent infrastructure analysis with pre-built models and sets a 


foundation for future analysis of other interdependencies and systems. 
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Executive Summary 





Critical infrastructure systems (CIS) are the foundation of modern society. CIS provide 
services like electric power, clean water, mobility, communications, and fuel. Without these 
services, modern society would experience significant impacts to the economy and safety, 
and infrastructure operations and maintenance to keep these systems in good working 
condition is crucial for day-to-day life. Understanding their vulnerabilities and responses 
to large-scale, rare, unexpected, or unknown failures is also essential to invest in projects 
with the highest benefit for society. A key recognition is that CIS are also interdependent on 
each other (e.g., water systems need electricity to function and power systems need water to 
function), such that the vulnerability of one system can affect the operations of another, and 
vice versa. Analysis of these interdependencies and their implications for system protection 


and resilience is an important area of research. 


This thesis focuses on developing standardized methods and tools that enable the modeling 
of interdependent CIS and assess their vulnerabilities. We focus our work on island and 
military installation CIS because they share a number of important features that make 
them useful for developing interdependency analysis methods. For example, many of these 
systems are at a local or community scale, have clear geographic and physical boundaries, 


and distinct ownership and operational boundaries. 


We review the literature on CIS modeling and vulnerability analysis to inform a generic 
framework for studying interdependent systems. CIS almost always have a network struc- 
ture, and their function is often modeled as a network flow problem. Whereas network 
optimization methods are widely used and pre-existing models exist, there are far fewer 
studies considering their interdependencies. The construction and optimization of interde- 
pendent models is not trivial, and is often completed by creating an entirely new model 
with interdependencies built in. However, we do not find a standard model formulation 
or implementation that considers the connection of pre-existing infrastructure models for 


interdependent analysis. 


We build upon recent work on interdependent multilayer network flow problems to de- 


velop a framework for combining pre-existing models. Our resulting framework generates 


Xvii 


network optimization models we call combo-models that link two networks together for 
interdependent analysis. We implement our framework using Pyomo optimization model 
objects and a generator function that takes user input for combo-model construction. This 
results in an easy way to link pre-built network flow models together for interdependent 


analysis. 


We validate our methods with interdependent energy network models. We implement fuel 
and electric power network flow models in Pyomo based on past studies. However, past 
studies included model elements for interdependent analysis in initial model formulation. 
Here, we develop the fuel and electric power networks as standalone Pyomo model objects, 
then use our combo-model generator function to add in necessary model elements. We 
validate this new approach with simple and realistic energy networks. Results show the 
combo-model methods enable interdependent vulnerability analysis and can reproduce 


results from past studies. 


Then, we develop a novel analysis of interdependent energy and transportation systems. 
We implement a pre-existing transportation model that was not created for interdependent 
infrastructure analysis. We use our combo-model methods to link it to fuel and electric 
power models. We analyze the interdependent function of energy and transportation sys- 
tems with simple and realistic networks developed for islands in the U.S. Virgin Islands. 
While models are fictitious, they show the versatility of the combo-model methods for gener- 
ating interdependent infrastructure models and demonstrate the importance of considering 


interdependencies in vulnerability assessment of islands and installations. 


Our methods and analyses provide a foundation for future CIS vulnerability research. 
The majority of analyses of interdependencies study at most two systems, where combo- 
model methods support analyzing a larger number of networks. Methods support federating 
optimization models with other operator models, such as simulation models for water 
systems. Finally, our methods focus on the physical interdependencies, where future work 
can incorporate others (e.g., geographic co-location). Taken together, future analyses on 
real systems using the combo-model methods enable new insight into CIS protection and 


resilience. 
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CHAPTER 1: 
Introduction 





The life and welfare of modern society relies on critical infrastructure systems (CIS) to 
provide services like electrical power, clean water, mobility, communications, and fuel. 
Infrastructure operations and maintenance to keep these systems in good working condition 
is crucial for day-to-day life. Understanding their vulnerabilities and responses to large-scale, 
rare, unexpected, or unknown failures is also essential to invest in projects with the highest 
benefit for society. A key recognition is that CIS are also dependent and interdependent 
on each other (e.g., water systems need electricity to function and electric power systems 
need water to function), such that the vulnerability of one system can affect the operations 
of another, and vice versa. Analysis of these interdependencies and their implications for 
system protection and resilience is an important area of research that supports safety and 
security. This thesis focuses on developing standardized methods and tools that enable the 
modeling of interdependent CIS and assess their vulnerabilities. 


1.1 Critical Infrastructure Systems 

The most important infrastructures for a functioning society are dubbed “critical” infras- 
tructure. What constitutes critical infrastructure depends on definitions found in guiding 
legislation, such as the definition used in the United States of America found in the U.S. 
Patriot Act of 2001, where critical infrastructure is defined as: “(...) systems and assets, 
whether physical or virtual, so vital to the United States that the incapacity or destruction 
of such systems and assets would have a debilitating impact on security, national economic 
security, national public health or safety, or any combination of those matters” (United 
States of America 2001). 


This definition emphasizes that the failure of a CIS — or worse, many of them — can have a 
huge impact on health, security and safety of the affected area and communities. Thus, it is 
the policy of the United States to ensure “that any physical or virtual disruption of the oper- 
ation of the critical infrastructures of the United States be rare, brief, geographically limited 
in effect, manageable, and minimally detrimental to the economy, human and government 


services, and national security of the United States” (United States of America 2001). 
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This policy was made practical in 2013 by Presidential Policy Directive (PPD) 21, Criti- 
cal Infrastructure Security and Resilience, which directed the U.S. federal government to 
“strengthen the security and resilience of its critical infrastructure against both physical and 
cyber threats” (The White House 2013). The goal of PPD-21 was to improve the resilience of 
CIS and attenuate potential impacts on “national security, economic stability, public health 
and safety, or any combination thereof” (The White House 2013). Here, PPD-21 defines 
resilience as “the ability to prepare for and adapt to changing conditions and withstand and 
recover rapidly from disruptions. Resilience includes the ability to withstand and recover 
from deliberate attacks, accidents, or naturally occurring threats or incidents” (The White 
House 2013). 


PPD-21 further delineates the sectors and systems that constitute CIS. The most critical 
of these systems outlined in PPD-21 were energy and telecommunication systems because 
of their enabling function for other critical infrastructures (The White House 2013). In 
addition, the following 16 critical infrastructure sectors are identified in PPD-21 and are 
currently the focus of federal efforts to improve CIS resilience: 


¢ Chemical ¢ Food and Agriculture 

¢ Commercial Facilities ¢ Government Facilities 

¢ Communications ¢ Healthcare and Public Health 

° Critical Manufacturing ¢ Information Technology 

¢ Dams ¢ Nuclear 

¢ Defense Industrial Base ¢ Transportation 

¢ Emergency Services e Water and Wastewater (The White 
e Energy House 2013) 


Financial Services 


Not only is the U.S. focusing on protecting CIS, but so are many other countries, unions and 
alliances. For example, the European Union provides its own definition of critical infras- 
tructure that guides European protection and resilience activities: “‘critical infrastructure’ 
means an asset, system or part thereof located in Member States which is essential for the 
maintenance of vital societal functions, health, safety, security, economic or social well- 
being of people, and the disruption or destruction of which would have a significant impact 
in a Member State as a result of the failure to maintain those functions” (Council of the 
European Union 2008). 


CIS protection and resilience is also relevant in military operations, such that the North 
Atlantic Treaty Organization (NATO) is also focusing on CIS resilience. After the decision 
at the 2016 Summit of the NATO in Warsaw to seek for preparation for a full spectrum of 
future threats (including any form of armed attack), the members agreed on the following 
seven baseline requirements for national resilience (North Atlantic Treaty Organization 
2020): 


1. Assured continuity of government and critical government services: for instance the 
ability to make decisions, communicate them and enforce them in a crisis; 

2. Resilient energy supplies: back-up plans and power grids, internally and across bor- 
ders; 

3. Ability to deal effectively with uncontrolled movement of people, and to de-conflict 
these movements from NATO military deployments; 

4. Resilient food and water resources: ensuring these supplies are safe from disruption 
or sabotage; 

5. Ability to deal with mass casualties: ensuring that civilian health systems can cope 
and that sufficient medical supplies are stocked and secure; 

6. Resilient civil communications systems: ensuring that telecommunications and cyber 
networks function even under crisis conditions, with sufficient back-up capacity. 
This requirement was updated in November 2019 by NATO Defence Ministers, who 
stressed the need for reliable communications systems including 5G, robust options 
to restore these systems, priority access to national authorities in times of crisis, and 
the thorough assessments of all risks to communications systems; and, 

7. Resilient transport systems: ensuring that NATO forces can move across Alliance 


territory rapidly and that civilian services can rely on transportation networks, even 
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in acrisis (North Atlantic Treaty Organization 2020). 


Overall, CIS resilience is a priority for numerous countries, unions, and alliances. The spe- 
cific justifications and systems that comprise CIS may differ, but their intent and application 
are very similar and well-integrated. Importantly, each country, union, and alliance focuses 
on identifying vulnerabilities within and across systems to develop effective resilience 


strategies. 


1.2 Critical Infrastructure Vulnerability 

Decisions to protect CIS and improve their resilience rely on technical methods for assessing 
CIS vulnerability. Interruptions in critical services occur for many reasons, such as natural 
hazards, resource unavailability, hostile or terrorist attacks, and technology failures. These 
stressful events on their own may not disrupt services, but rather the failure of infrastructure 
as a result from these events do. Thus, it is important to identify the likelihood and conse- 
quences of infrastructure losses before they occur. The goal of CIS vulnerability assessment 
is to use different perspectives on event likelihood and consequences to determine the assets 


or sub-systems, that, if failed, lead to the greatest impacts on society. 


CIS vulnerabilities originate from many different sources. For example, poorly operated, 
and maintained infrastructure is vulnerable because it is unreliable and likely to fail during a 
stressful event (or even during normal operations) (Zio 2016). Infrastructure that is in high- 
risk locations that experience frequent disasters and attacks are also vulnerable because 
they are the more likely to experience stressful events (Haimes 2006; Aven 2011). Systems 
with poor designs that are easily exploited or have single points of failure are vulnerable, 
especially if targeted by adversaries (Alderson et al. 2014). And systems with ineffective 
decision-support tools to sense, anticipate, adapt, and learn (Park et al. 2013; Thomas et al. 
2019) from surprises are vulnerable to surprising events that challenge normal operations 
(Eisenberg et al. 2019). 


In all cases, CIS are commonly found to be unreliable, risky, easily targeted, surprised, 
or otherwise vulnerable when they have underappreciated interdependencies with other 
infrastructure systems (Clark et al. 2019). Dependencies or interdependencies between 
different CIS (e.g., electric power and water) make a failure in one system affect another, 


and vice versa. Importantly, interdependencies can lead to cascading failures, where initial 
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losses in one system cascade to affect the operations of another. An example of such a 
dependency or interdependency is a power outage in a electric power network, which leads 
to an outage of a water pump in a water distribution network. Cascades can also affect 
the original infrastructure system exacerbating previous service losses, such as if the water 
pump that failed in the previous example was used for cooling power generation plants. Here 
a power failure can cascade through the water system to create a larger power interruption. 


Interdependencies influence vulnerability and can impact service provision at all scales of 
CIS operations (e.g., national, regional, and local). This thesis is specifically motivated 
by examples of interdependencies that affect civilian and military CIS at the community, 


island, and military installation scale. 


1.2.1 Island and Military Installations Systems 

CIS vulnerability and resilience analysis at the local scale is crucial for advancing knowledge 
of interdependencies and their effects. Many CIS across the U.S. are regional in operation 
and management, such that source of vulnerabilities are difficult to pinpoint due to the 
numerous owners, operators, and interconnected assets that must be considered in analysis 
(Alderson 2019). Here, the implications of a single dependency or interdependency across 
systems may be difficult to quantify. Analysis of local CIS systems at the community scale is 
more straightforward and the effects of interdependencies across systems can be explicitly 
modeled and quantified. 


Island and military installation CIS share a number of important features that make them 
particularly useful for developing interdependency analysis methods and tools. First, many 
island systems are at a local or community scale, simplifying analysis. Island and instal- 
lations also have clear geographic and physical boundaries that isolate them from nearby 
or regional CIS, such as isolated locations or a “fenceline” separating civilian and military 
systems. These geographic and physical boundaries exist both within the continental U.S. 
and in more remote environments like island territories and military outposts. Related to 
physical borders are distinct ownership and operational boundaries as island and installation 
systems tends to be managed separately from larger regional systems. This reduces analysis 
complexity by only involving decision-making by one or few entities. Finally, island and 


installation systems often have more stringent constraints, such that there is limited physical 


space, funding, or otherwise limits on the size and complexity of the systems and what they 


can manage. 


Examples of island systems motivating this work are the lifeline infrastructures in the U.S. 
Virgin Islands (USVI). In 2017, two Category-5 hurricanes (Irma and Maria) made indirect 
hits on the USVI territory within a two-week period. Since these events, there has been 
significant work to assess the vulnerability and resilience of island electricity (Bunn 2018; 
Wille 2019), water (Wille 2019; Borgdorff 2020), transportation (Good 2019; Routley 2020; 
Bengigi 2020), and telecommunications systems (Wine 2020; Moeller 2020). Vulnerabilities 
of individual systems in the USVI are exacerbated by interdependencies. For example, loss 
of electricity can cause water and internet outages and failure of power poles can block 
roadways (Good 2019). Loss of internet and wireless communications impacts recovery 
operations across all systems as many USVI operators use cell phones for coordinating 
recovery (Wine 2020). Failures in water systems can lead to flooded and destroyed roads 
impeding some communities from accessing disaster supplies (Routley 2020). And failures 
in transportation systems slows down the recovery of all USVI CIS by reducing the mobility 
of recovery crews and equipment (Bengigi 2020). 


Examples of installation systems motivating this work are the CIS that support mission 
essential functions across military services and have experienced recent, major disasters. 
For example, Marine Corps Base Camp Lejeune in North Carolina, that was hit by Hurri- 
cane Florence in September 2018 which disrupted installation CIS and mission essential 
operations (Klare 2019). In particular, the methods developed in this thesis are meant to 
support resilience requirements set by the U.S. Department of Defense (DoD) for military 
installations in response to these disaster events. Resilience requirements within the DoD 


vary by branch and related critical service needs: 


¢ U.S. Navy: The Navy requires electric energy supply for 7 days after being discon- 
nected from the public grid or not delivered by it. This is being accomplished mostly 
by local fuel powered generators at important parts of the internal grid (e.g., hospi- 
tals, command and control facilities, or dining facilities) (Navy Facilities Engineer 
Command 2017). 

¢ U.S. Air Force: The Air Force also requires 7 days of guaranteed energy supply for 
critical infrastructures on their bases or for the time needed to relocate a mission if it 


takes longer (Secretary of the Air Force 2020). 

¢ U.S. Army: To ensure mission-essential functions for supporting critical missions, 
the Army is requiring continuous water and electric power supply for at least 14 days 
(Secretary of the Army 2017). 

¢ U.S. Marine Corps: The Marine Corps follows the same requirements as the U.S. 
Navy for energy resilience. However, similar to the Army, the Marine Corps plans to 
be self-reliant on electric energy and water for a minimum of 14 days (Marine Corps 
Installations Command 2019). They are also considering food distribution, logistical 


mobility, and communications. 


1.3. Operations Research Techniques for Vulnerability 
Analysis 

CIS vulnerability analysis is supported by the three pillars of Operations Research — 

optimization, statistics, and stochastic processes. However, optimization models form the 

technical basis for the vast majority of CIS vulnerability assessments. Since CIS are almost 

always having a network structure, they can easily be modeled as a network flow optimization 

problem (Alderson et al. 2014), where the type of the problem depends on the type of the 


infrastructure: 


¢ Electric power networks can be modeled as minimum cost network flow problems; 

¢ Potable water distribution networks can be modeled as maximum flow problems; 

¢ Transportation networks (e.g., streets and railroad networks) can be modeled as multi- 
commodity flow problems; and, 


¢ Mobile telecommunications can be modeled as coverage problems. 


Essentially every CIS can be represented as a network and its operations can be modeled 
with an appropriate optimization problem. In general, the objective function for a CIS 
optimization model relates to the system function. Vulnerability analysis using optimization 
models can be conducted by studying the system function during normal operations and 
measuring changes in function after the CIS is damaged (Sharkey et al. 2020). This can be 
done by either using network interdiction models to optimize which connection removal 
would have the largest impact on the model, or using exhaustive enumeration, where every 


possible state of a network is being modeled, run and analyzed (Alderson et al. 2015). 


Here, network damage is represented by binary variables that indicate functioning and 
non-functioning infrastructure (Sharkey et al. 2020). Whereas exhaustive enumeration is 
computationally intensive and may be infeasible to complete in a reasonable time period, 


but is easier to model and generalize. 


Instead of using binary variables for network damage, it is also possible to introduce 
uncertainty with stochastic interdiction, so that the damage to network components is not 
definite, but has a probability of failure Sharkey et al. (2020). The objective (value) of the 


optimization problem will then have a lower and upper bound, instead of a fixed value. 


Whereas network optimization methods for CIS vulnerability analysis are widely used, 
there are far fewer studies considering network interdependencies with other CIS systems. 
For analytical purposes, it is more efficient to analyze infrastructure network vulnerability 
without considering interdependencies to support disaster operations. However, this does 
not consider connections to other infrastructures and cannot capture cascading failures that 
originate in one CIS and cause problems on other networks. Importantly, it is difficult 
to identify the operational and functional effects of interdependencies without explicitly 
modeling both networks and their connections. This is why interdependent models are 


important to gain insights in the behavior of these interconnected networks. 


The construction and optimization of these interconnected models is not trivial, because 
of their diversity of functions and their associated optimization problems. In fact, some 
CIS operations and physics are so complicated that it is common practice to simulate 
infrastructure operations instead of optimizing them. However, simplifying too much can 


lead to analysis problems and an inability to properly characterize vulnerabilities. 


For example, a source of problems when handling damage or disturbances of an infrastruc- 
ture network can be the human-in-the-loop (Eisenberg et al. 2020). Vulnerability analysis 
usually assumes that the operator of a infrastructure system is totally and correctly aware 
of the problem and is acting accordingly. But humans usually don’t act as expected. For 
example, sensing to be aware of and understand disaster impacts must be available to 
decision-makers to make “correct” decisions. The effect of correct and incorrect decision- 
making is not, or cannot be easily implemented, in standard CIS optimization models. 
Interdependencies exist here as well, such as networks interconnected with telecommuni- 


cation networks and control systems (supervisory control and data acquisition (SCADA)), 
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called cyber—physical—social (CPS) systems. Eisenberg et al. (2019) wrote about the prob- 
lem of having a model as a decision support system for control personnel of CIS. The factor 
of being “surprised” and thus not understanding what the real kind of a problem is, can 
worsen a humans’ reaction, because of inputting the wrong data into the decision support 
system, drawing wrong conclusions and then acting wrong for the system or being forced 


to improvise. 


Overall, more research should be conducted to advance network optimization to consider 
interdependent effects and relate these models to network resilience. Sharkey et al. (2020) 
outlines four key concepts defined by (Woods 2015) of resilience that are supported by 
network optimization models, with an emphasis on CIS systems: robustness, rebound, 
extensibility, and adaptability. A better understanding of the effect of interdependencies 
on CIS operations and vulnerabilities supports each of these concepts and their associated 


resilience goals. 


1.4 Thesis Goals 


The goal of this thesis is to develop a standard way to consider CIS interdependencies using 
optimization models. In particular, we build on methods for considering interdependencies 
in network flow optimization and apply them to infrastructure networks. We develop a 
computational framework and architecture that enables the modeling of different types 
of infrastructure networks in a standardized way. We demonstrate our approach using 
established interdependent models for fuel and electric power systems and demonstrate 
their validity for vulnerability assessment of three or more systems with a new model of a 


transportation network, which was never constructed for interdependent system analysis. 


THIS PAGE INTENTIONALLY LEFT BLANK 
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CHAPTER 2: 


Literature Review 





To standardize the modeling and analysis of interdependent infrastructure systems, we 
review which CIS interdependencies exist, how they work, and how they have been studied 


with models and available open source software. 


2.1 Critical Infrastructure Interdependency Concepts 

The relationship between interdependencies and CIS vulnerabilities was first mentioned in 
the report of the U.S. President’s Commission on Critical Infrastructure Protection (PCCIP) 
in 1997 with respect to cyber dependencies (President's Commission on Critical Infrastruc- 
ture Protection 1997). Based on this report, canonical research was completed by Rinaldi 
et al. (2001) to develop a useful taxonomy of interdependencies that has influenced the 
research field. Rinaldi et al. (2001) describes interdependencies across CIS in terms of 
shared needs. These needs are defined as dependencies and interdependencies, where de- 
pendencies are unidirectional (one system only depends on the other) and interdependencies 
are bidirectional (both depend on each other). Rinaldi et al. (2001) also describes CIS as 
Complex Adaptive Systems (CAS). This expression describes, that infrastructures and their 
parts can be seen as interacting entities, which are exchanging information and/or resources; 
and while getting and sending this goods, each infrastructure is adapting itself to its con- 
text and other infrastructures. This relates to supply and demands from dependencies and 


interdependencies. 


Examples of interdependencies presented by Rinaldi et al. (2001) are reproduced in Fig- 
ure 2.1, which shows how many interdependencies exist even with few CIS for normal 
operations. This number and complexity of these relationships increases with every added 


system. 
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Figure 2.1. Examples of Interdependencies from Rinaldi et al. (2001). The 
authors show shared needs across electric power, water, oil, transportation, 


natural gas, and telecommunications systems. The complex relationships 
lead to interdependencies across different networks such that failures in one 
system can affect the function of another. 


One of the key contributions of Rinaldi et al. (2001) was a taxonomy of different CIS 
interdependencies. In particular, the authors define four distinct interdependencies: 


¢ Physical: when infrastructure systems are connected via supply and demand relation- 
ships to enable operations (e.g., a water-pump requiring electricity to operate); 

¢ Geographic: when infrastructure are nearby each other in physical space and can be 
affected by the same problem (e.g., a natural disaster) due to their proximity; 


¢ Cyber: when infrastructures must exchange or share information to operate (e.g., 
SCADA systems to manage the electric power grid); and 
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¢ Logical: when infrastructures have rules, decision-making, and regulatory needs that 
enable or inhibit collaboration and coordination (e.g., blackouts caused by ineffective 


fuel contracts even if the natural gas system is functioning and gas is available). 


The goal of incorporating physical, geographic, cyber, and logical interdependencies in CIS 
vulnerability analysis is to determine how they may lead to unexpected system failures. Ri- 
naldi et al. (2001) also defines several ways in which interdependencies lead to infrastructure 


failures: 


* common cause failure, where the failure of two or more systems is caused by the 
same reason (e.g., earthquake, flooding, etc.); 

* cascading failure, where the breakdown of an infrastructure system causes another 
one to fail (e.g., water pump not working because of a loss of electric power); and, 

¢ escalating failure, where the loss of a system results in a longer recovery time 
of another system, both failed by different reasons (e.g., damaged road leads to an 


increased driving time of a repair crew for other infrastructure). 


Since Rinaldi et al. (2001), several authors have made important contributions to CIS 
interdependency concepts. Sharkey et al. (2016) advanced interdependency concepts to 
consider system restoration in addition to failure. After a CIS failure, it can be difficult to 
restore systems because of an interdependency when trying to repair them. Sharkey et al. 
(2016) defined this type of interdependency, a restoration interdependency, as follows: 
“A restoration interdependency occurs when a restoration task, process, or activity in an 
infrastructure is impacted by a restoration task, process, or activity (or lack thereof) in 
a different infrastructure” (Sharkey et al. 2016, p. 1). Sharkey et al. (2016) demonstrates 
that restoration interdepedencies make it is very important to have effective communication 
between different network operators to restore interdependent services. An example for 
this type of interdependency would be if electric power is needed to repair a part of a 
water network, but the issue in the water network was caused by a power outage and the 
electric power is not yet restored. In general are these types of interdependencies only reveal 


themselves if an extreme event causes the failure of multiple infrastructure networks. 


In addition to the effects of interdependencies on failures and recovery, Derrible (2017) 
provides an overview of how interdependencies in urban systems relate to infrastructure 


development practices. Interdependencies are very important when planning urban CIS 
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because the density of infrastructure and the amount of needed supplies is higher. As 
older cities had a lot of time to grow from a few houses to small villages or big cities, 
their infrastructure is mostly interconnected with a semi-lattice structure because it grew in 
the same speed as the city. When planning new cities and building them up quickly, CIS 
tend to have a hierarchical tree structure (see Figure 2.2). Here these supply systems are 
called urban infrastructure systems (UIS) and Derrible (2017) emphasizes the importance 
of good and intensive communication and coordination between the different departments 


and companies, who are mostly only responsible for one UIS each. 


While the semi-lattice structure is more complicated and requires more coordination, semi- 
lattice structures demonstrate more resilience to failures than hierarchical trees. In a semi- 
lattice structure, the damage of an arc has, in the best case, no influence on system function. 
This emphasizes decentralization for system robustness, but also emphasizes the need 
for to assess system function alongside interdependencies as their robustness may hide 
latent vulnerabilities. In contrast, hierarchical systems only require a single main arc (e.g., 


bottleneck) to be broken and the entire system may fail to function. 





Figure 2.2. Network Representation of Tree versus Semilattice. Critical in- 
frastructure is often planned and designed with a top-down perspective that 
produces systems with tree-like structure (left). Derrible (2017) argues that 
the dependencies between multiple systems (numbers) at different scales 
(letters) lead to semi-lattice interdependencies that can cause cascading and 
unexpected failures (right). Source: Derrible (2017). 


We build on these interdependency concepts to develop models of CIS systems. In particular, 
we build on the taxonomy of interdependencies developed by Rinaldi et al. (2001) to guide 


the connection of CIS models. We relate vulnerabilities to their effects on system failure. 
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2.2 Modeling Interdependent Infrastructure 

There is significant research motivating the need to study interdependent infrastructure sys- 
tems with operations research-based approaches. We review the advantages of optimization 
and simulation-based methods for interdependent infrastructure modeling and described 
a series of infrastructure operator models useful independent and interdependent system 


analysis. 


2.2.1 Generic Methods for Interdependent System Modeling 

Ouyang (2014) provides a comprehensive review of interdependent infrastructure models 
and their relationship to system vulnerability and resilience. Ouyang (2014) overviews 
studies of interdependent systems in the following CIS sectors: 


¢ Telecommunications ¢ Transportation 

¢ Electric Power Systems e Water Supply Systems 
¢ Natural Gas and Oil ¢ Government Services 
¢ Banking and Finance ¢ Emergency Services 


Across the literature, Ouyang (2014) identifies different approaches for modelling inter- 
dependencies and their advantages and disadvantages. The author compares analytical 
approaches based on their ability to improve resilience across 16 sample strategies. Ouyang 
(2014) finds High Level Architecture (HLA)-based model able to support all 16 strategies 
because it is a hybrid approach, integrating other of interdependency analysis. Besides 
hybrid approaches, Ouyang (2014) finds network-flow-based methods useful for support 
11 resilience strategies and simulation-based methods like Agent-Based Modeling (ABM) 
supporting 8 resilience strategies. Together, optimization via network flow and simulation 
via ABM (or otherwise) methods can yield a comprehensive approach to assessing CIS 


interdependencies. 


Several methods discussed by and developed since the review by Ouyang (2014) are generic 
to support the analysis of any infrastructure system. An influential approach for modeling 
infrastructure interdependencies with network optimization was based on economic Leontief 
input-output models (Leontief 1951). Leontief modeled the required goods needed from 


each economic sector for a specific sector in economy to be able to maintain production. 
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This model was adapted to fit the interdependencies between infrastructure models, where 
economic sectors are replaced with infrastructure systems and the amount of production 
represented the system functionality. Recent advances in network flow optimization and 
interdependent infrastructure analysis are largely similar to this method. However, rather 
than treating CIS as sectors, network flow optimization explicitly models CIS components 
and their interactions, which is necessary to understanding vulnerability (Ouyang 2014). 


Here, system function is measured via optimal flows across network systems. 


When using network optimization models it is not only possible to compute the optimal 
flow and to detect what happens during a failure scenario (e.g., a pipeline break), it is 
also possible to construct game theoretic and bi-level optimization to maximize network 
damage and identify worst-case failures. Alderson et al. (2014) describes this approach as 
an Attacker-Defender (AD) or Defender-Attacker-Defender (DAD) model, where AD uses 
a bi-level framework where worst-case attacks are represented by binary variables turning 
CIS components on and off. DAD is a tri-level framework that includes an initial design 
phase to protect networked CIS. In all cases Alderson et al. (2014) describes CIS as operator 
models since their optimization represents the worst-case or best-case operations of realistic 
systems. For the remainder of this work, we use this term for optimization models applied 
to CIS (Alderson et al. 2014). 


Network optimization models are insufficient for CIS vulnerability analysis because they 
are not able to simulate the effects of discrete events. Instead, it is recommended to include 
stochastic and simulated events in optimization for performing interdependency analysis. 
This is possible with Object-Oriented Modeling (OOM) techniques possible in most stan- 
dard programming languages (Nan and Eusgeld 2011). Developing simulations, such as 
an ABM where the behavior of individual objects of the model is defined and simulated 
over time, OOM is used to give individual model units updateable information and create a 
global clock for tracking system behavior and enable networked elements to communicate 
with each other. This technique enables time-dependent and event-driven simulations that 
are generally not studied with network flows. Some CIS function are normally modeled 
in this way because their physics are too complicated to solve with optimization. For ex- 
ample, hydraulic balancing is a simulation-based method that is standard to model water 


distribution system operation used across the potable water industry (Klise et al. 2018). 
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When combining multiple simulation models (hybrid approach), HLA and Distributed 
Interactive Simulation (DIS) are the most used frameworks. With these frameworks the 
connection between multiple simulations is modeled. Mostly the simulations are running 
parallel and exchange information and status via the framework, so that they stay synchro- 


nized. 


Recent work by Enayaty Ahangar et al. (2020) recommends the use of multi-layered network 
flow models for analyzing interdependencies between CIS, where each infrastructure is a 
different network layer (or set of layers). In this approach, CIS components are represented by 
network nodes and arcs and flow within and among networks represents the system function 
(for example electric power). Here, the operability of components depends on the flow in 
another layer or consumes a transported good of another layer of the model. Importantly, 
this approach is similar to the way interdependencies are modeled in Sharkey et al. (2016), 


such that they can capture input-output relationships and restoration interdependencies. 


The model presented by Enayaty Ahangar et al. (2020), measures network function via 
the flow in the network and how efficiently this flow is being routed through the network. 
This is possible via min-cost network flow optimization, where cost can be monetary or the 
amount of time needed. The authors demonstrate the model using generic interdependent 
infrastructure systems with flow optimized as interdependent multi-layered network flow 


(IMN) model as a mixed-integer programing (MIP) model to maximize performance. 


2.2.2 Operator Models for Critical Infrastructure Systems 

We build on this literature to apply interdependent infrastructure modeling and analysis 
methods to CIS. Here, we review operator models for CIS without interdependencies to 
describe their normal function and analysis. Our review focuses on lifeline infrastructure 
systems relevant to island and military installation operations, i.e., fuel, electricity, water, 
transportation, and telecommunications systems. Here we overview only the most recent 
and relevant work. We refer the author to Sharkey et al. (2020) for an broader review of 


operator models and their relationship to CIS, vulnerability, and resilience. 
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Fuel 

One of the most well-studied examples of an operator model is the notional fuel model 
presented in Alderson et al. (2015) (Figure 2.3). This operator model was developed to show 
the output of AD and DAD methods for resilience analysis. This is a very simple model 
with only two supply nodes (black) and 14 demand nodes (white) with a few redundant 
connections to ensure the network is N-1 reliable. It is used to analyze the influence of 
damaged connections between the nodes and show how well the system operator is able 
to adapt to the situation. The network operations is similar to a real fuel system, with the 
objective to minimize the cost of supply. 





Figure 2.3. Notional Fuel Network from Alderson et al. (2015). This network 
is an example operator model for a fuel system. Black nodes are supply nodes 
and white nodes are demand nodes. 


Operations are measured modeled and solved as a linear program. Originally implemented 
and solved in General Algebraic Modeling System (GAMS) (GAMS Development Corpo- 
ration 2020) by Alderson et al. (2015) and then Dickenson (2014), it was later implemented 
using Pyomo (Hart et al. 2017) by Ruether (2015) for modeling interdependencies in a fuel 
and electric power network. The optimization in the fuel network is done by minimizing 


cost and assigning cost for each arc, a unit of fuel is pumped through and extra cost if a 
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nodes’ demand is not met. Additionally there is a maximum capacity per arc assigned. This 
guarantees that the shortest possible path in the network is chosen with the priority that all 


possible nodes get supplied. 


Electric Power 

A very popular CIS for study is an electric power network. In general, electric power 
networks consist of three stages. First, the electric power is generated by an electric power 
plant of any type (e.g., gas, coal, nuclear, wind, solar, water). For the long-distance transport, 
and to keep losses as small as possible, the voltage is stepped up to high-voltage for 
long-distance transmission. This transformation of the voltage happens at transformers and 
substations. Near the consumer, the voltage is stepped down for distribution to households 
or large scale customers (e.g., industry and businesses). This is all connected in a network, 


often where different voltages stages are separated by substations (Bunn 2018). 


Often, transmission and distribution networks each use a different operator model. For 
transmission, Direct Current Optimal Power Flow (DCOPF) is used because either it is a 
direct current line or networks are assumed to have balanced flows across all phases, making 
many physical effects of related to impedance negligible. This is because the position of 
all three phases of the power line are being rotated, so that the physical (electromagnetic) 


impacts on the power transmission cancel out. 


For the distribution stage on shorter distances the physical effects do not cancel out and the 
more complicated Alternate Current Optimal Power Flow (ACOPF) model should be used 
to compute these effects and get more realistic results of the unbalanced loads in the electric 
power network (e.g., Nagarajan et al. 2016). Petri (2017) used Pyomo to solve a ACOPF 
based model with assigning cost for each shed kilowatt (KW) load and minimizing the sum 


of this cost. 


Water 

The most common operator model for potable water systems is the Water Distribution 
Network (WDN). The structure and function of most WDNs follow the system in Figure 2.4. 
Water is either withdrawn from a natural fresh water source (e.g., lake or groundwater) or 


sea water is converted into fresh water with desalination or reverse osmosis. Afterwards 
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water is treated for human consumption in a water treatment plant with different types 
of filters, UV-illumination or chlorination, and is then pumped into a storage tank. These 
storage tanks are mostly on an elevated position (e.g., on a hill or as a tower) and supply a 


community with water by gravity, supported by pumps for the correct water pressure. 


The computing the behavior of a water distribution network is done with water network 
simulation. Bunn (2018) used the Water Network Tool for Resilience (WNTR) (Klise et al. 
2018), a Python-based (Python Software Foundation 2001) package for simulating and 
analyzing the resilience of a WDN, based on the EPANET software application (U.S. 
Environmental Protection Agency 2000). WDN are modeled by using pipes, pumps, tanks 
and sources. Pipes are connected by junction nodes, where the withdrawal of water takes 
place. These elements together are used by the simulation using a pressure dependent 
demand (PDD) model to compute the flow of water via hydraulic balancing. 







Storage 
Tank 


Treatment 
Plant 








| Note: Pumps and valves are located at a variety of locations throughout 


| the distribution a 


Figure 2.4. Drinking Water Distribution System. Water is pumped from a 
water source, treated for human usage in a treatment plant, and stored in an 
elevated tank to supply households by gravity. The flow of water is supported 
by pumps. Source: U.S. Environmental Protection Agency (2020). 
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Transportation 

Mobility across transportation systems can also be represented with operator models. One 
common example is the movement of vehicles and supplies over surface roads. Good 
(2019) built a network optimization model of a transportation network, using the streets 
on the island of St. Croix in the USVI. The purpose was to model the traffic after an 
extreme event disaster and determine which part of the island has the most difficult reaching 
locations of disaster supplies (e.g., gas stations, groceries, and hardware stores). This model 
was built as a minimum cost multi-commodity network flow model. System functions is 
determined by network congestion, such that flow is slowed down with increasing traffic 
until a traffic jam arises. The objective function contains the minimization of the number of 
vehicle-hours spent on each arc (street) with a penalty function for dropped transportation 
due to congested streets. Each arc has a capacity, based on the type of street (dirt, rural, 
urban and highway). This problem was also solved using Pyomo. 


Telecommunications 

Telecommunication networks, such as backbone internet and wireless networks, can also be 
modeled as a minimum-cost network flow problem. Martin (2014) created a network flow 
problem on a fictitious island Dystopia (described in detail in Alderson and Darken 2019). 
Internet users are connected via their Internet Service Provider (ISP) to a network node and 
their traffic is being routed through the network to the target node. Connections between the 
nodes are assumed as optic fiber connections with negligible influence on the transmission 
time but with capacity restriction (data bandwidth). The part in this network with the most 
impact on the speed are network nodes, because at each hop, where data traffic is routed 
from one connection to the other, the router has to analyze each data package to find the 
correct destination connection, which consumes a small amount of time. The objective 


function of this model is to minimize the number of hops (traversed router). 


The minimum hop model was used to determine worst-case failures with a network interdic- 
tion problem for destroyed connections. This was modeled in GAMS (GAMS Development 


Corporation 2020) and used to determine network hardening requirements. 
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2.2.3 Interdependent Operator Models 

One of the goals of this thesis is to develop standardized ways to connect independent 
operator models together for interdependent analysis. In general, dependencies and interde- 
pendencies are only studied for pairs of infrastructure systems. We review some well-studied 


examples motivating this work. 


Figure 2.5 presents one approach to create two interdependent infrastructure models. In 
general, interdependent operator models are the result of combining two pre-existing net- 
work flow model formulations. As a motivating example, we consider the case where a fuel 
network depends on a electric power network. The grey model represents a fuel network 
that depends on electricity to operate, where operator objectives and constraints for fuel 
delivery are combined with constraints and parameters for electric power dependencies. 
This model can be studied on its own to understand the function and vulnerability of a fuel 
system when electric power is unavailable. For interdependent analysis, the grey model is 
combined with a electric power model that determines how electricity is delivered across 
a electric power network including assets in the fuel system (e.g., pumps). Together, the 
two form an interdependent network flow model that is based entirely on model elements 
inherited from the existing formulations, such as a shared objective, flow constraints, and 


dependency constraints from the fuel model. 
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Figure 2.5. Common Approach to Create Interdependent Operator Models. 
Interdependent operator models are often the result of combining two stan- 
dalone operator models. Here fuel and electric power models are considered 
as a motivating example. Dependencies of the fuel model on electric power 
delivery are included in fuel model formulation. Then, the two models are 
combined with a shared objective, constraints for network flows, and con- 
straints for dependencies. Essentially all interdependent operator models in 
the literature are created with a similar process. 


Fuel and Electric Power 

A combined fuel and electric power network was modeled by Dickenson (2014) in GAMS 
(GAMS Development Corporation 2020) and then adapted to the Python-based Pyomo 
by Ruether (2015). Both independent models (fuel and electric power) were modeled and 
solved independently, then connections were added and both models were solved together 


as a combined network optimization model. The interdependencies across systems include 
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the need for electric power generators to access fuel from the fuel network to function. If the 
available fuel is lower than a specified threshold, the generator does not produce any electric 
power. There are also fuel connections (arcs) that need electric power to be able to transport 
fuel, so if the available electric power is lower than a specified threshold, the fuel pump 
is not working and fuel is not transported. Thus, the modeled interdependencies included 
in this model are exclusively physical interdependencies due to shared supply and demand 
needs. The combined operator model analyzes the impact of failures in one of the systems 
on the other system, such that cascading failures can happen and considered in vulnerability 
analysis. For this connected model two minimal cost network flow models were used, so 
that the model consists of sub-models and additional constraints. The analysis with these 
models has important implications for the resulting behavior of the connected systems. For 
example, Dickenson (2014) shows that changing how fuel and electric power connections 
are modeled, the interdependent model might converge to suboptimal solutions or fail to 


converge at all. 


Water and Electric Power 

Bunn (2018) combined an electric power network flow optimization model with a WDN. 
The water model was built using WNTR and combined with the Pyomo electric power 
model from Petri (2017) using ACOPF. Bunn (2018) ran the two models for a 24-hour 
time-frame and updated them each hour, so that the water model results were passed to 
the electric power model, then this model ran and the results were passed back to the 
water model. He modeled physical (e.g., water pump using electricity) and geographic (i.e., 
co-located node) dependencies. For testing this combined simulation/optimization he used 


three simple excursions (power outage, water demand spike and water demand drop). 


A similar problem was also analyzed by Zuloaga et al. (2020). They combined an electric 
power network with a WDN. Both infrastructure networks rely on each other, where water 
is used to cool electric power plants and electric energy is used to pump the water. They 
used EPANET (U.S. Environmental Protection Agency 2000) (on which WNTR is based) 
to complete WDN simulation, and optimized the flow in this network by using MATLAB 
(Higham and Higham 2017). To solve the electric power flow and unit commitment problems 
in the electric power network, they combined different techniques. The unit commitment 


(which power plant produces when) is solved every 24 hours with a module which is 
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programmed in A Mathematical Programming Language (AMPL) (Fourer et al. 1990) and 
the optimal power flow is computed by using the General Electric Company (GE) Positive 
Sequence Load Flow (PSLF) software. WDN optimization was done by a genetic algorithm 
and was run for four weeks (672 h). The example computations were done on a toy network, 
where the electric power network was composed of five power plants with different generator 
fuel types (nuclear, coal and gas), each having a storage tank for cool water. These were 
supplied by fresh water and recycled water, each being pumped with pumps needing electric 


energy. Additionally there was fresh water provided to two cities. 


Electric Power and Transportation 

Goldbeck et al. (2019) combined a electric power and transportation network to assess the 
interdependencies of London’s metro and electric power network given a simulated flooding 
incident. For this, an asset failure simulation was combined with a network flow optimization 
model via a HLA simulation (Figure 2.6). First, before running the general simulation 
and optimization model, stochastic asset failure scenarios were generated including their 
failure propagation probabilities to other assets, based on diverse interdependencies. Then, 
both network flow optimization models were solved in time-steps (e.g., hours) including 
a planning horizon with influence from the asset failure scenarios (e.g., unmet demand is 


moved to the next time-step) and their already completed repairs. 
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Figure 2.6. Interdependent Infrastructure Modelling Framework from Gold- 
beck et al. (2019). The author's modelling framework is a good example of 
a standardized approach to consider system failures and apply them on a 
dynamic network flow model to analyze interdependencies. 


Assets & 
hazards 



























li 
dependencies 


Overall, there is a diversity of models and methods to represent CIS as operator models 
and assess their interdependent vulnerability. Accordingly, there are numerous ways to 
implement frameworks for connecting and assessing operator models. We review some 
programming implementations to describe available software and programming packages 
that support thesis goals. 


2.3. Implementing Operator Models 

To simplify our review and methods development, we focus on object oriented programming- 
based implementations. There are several publicly available Python software packages 
available for simulating or optimizing infrastructure operator problems. Despite packages 
for optimizing network flow, assessing damage probabilities, and their effects, to the best 
of our knowledge, there are no available packages with the capabilities for interdependent 
infrastructure modeling we propose in this thesis. Still, four packages provide an overview 


of available software representative of the best available approaches to operator modeling. 
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2.3.1 PylIncore: Python Interdependent Networked Community Re- 
silience Modeling Environment 
PyIncore is a Python package developed by a large number of universities funded by the 
National Institute of Standards and Technology (NIST) (Center for Risk-Based Community 
Resilience Planning 2020). It is a Python-based interface to access the Interdependent 
Networked Community Resilience Modeling Environment (INCORE). This environment 
enables damage and functionality assessment and also has some economic and recovery 
functions. A large database of input-data is available and it is suggested to save the used 
input data on the INCORE-Server. For using the package, a previously generated and 
unlocked account is necessary and used for authentication before each use of the software. 
The analyzing approach is risk-based, using different scenarios and comparing them. The 
mode of operation is that a specific hazard is applied on geospatially assigned infrastructure 
(defined by building data and fragility data). This yields a damage value for every single 
infrastructure in the model. From this damage data the functionality of buildings, the 
economic impact and the needed recovery force can be estimated. At this time the hazards 


are limited to earthquakes, tsunamis, tornadoes and hurricanes. 


PyIncore has very modular implementation in Python, which facilitates the re-usability 
of functionalities. The functionality is based entirely on the geographic position, so it is 
not directly comparable to a physically interconnected network flow analysis, but geospatial 
interdependencies are an interesting influence on models to consider. The input-file datatype 
is JavaScript Object Notation (.json), so very similar in usability as Comma-Separated 
Values (.csv). PyIncore is designed to assess damage probabilities of independent buildings 


and structures to different types of hazards. 


2.3.2. EGRET: Electrical Grid Research and Engineering Tools 

The second package is the Electrical Grid Research and Engineering Tools (EGRET) 
(Knueven et al. 2019). This Python package is based on Pyomo and used for optimizing 
the power flow in a electric power network using DCOPF or ACOPF and for optimizing 
the unit commitment problem. With this the allotment of the use of different generators is 
optimized to reach a specific target like fulfilling the energy demand or minimizing cost. 
This package is exclusively limited to electric power networks and does not seem to have 


support for other types of infrastructure networks (e.g., water, transport, communication). 


Zi 


The implementation of EGRET is very modular, each module can be easily reused and it 
has an effective installation procedure. The python objects are documented with docstring 
and for testing the source code after changes, unit testing is implemented by using PyTest. 


2.3.3. LANL-ANSI: Los Alamos National Laboratory’s Advanced Net- 
work Science Initiative 

The next package is the Los Alamos National Laboratory’s (LANL) Advanced Network Sci- 

ence Initiative (ANSI), called LANL-ANSI (Tasseff 2020). This is not a single optimization 

framework or software, but a collection of multiple similar optimization projects. Single 

infrastructure network optimizations alongside with combined network optimizations are 


available (e.g., gas, electric power, water and combined gas and electric power). 


Projects in LANL-ANSI are implemented in the Julia Programming Language (Bezanson 
et al. 2017) which is used for numerical analysis, and even if it does not fit in our scope, this 
package is interesting to revisit. Input data can be imported from broadly used file types, 
like .dss for electric power networks and .inp for water networks. When using systems 
combining multiple infrastructure networks, the interconnection is modeled in a separate 
data file (for example using the JavaScript Object Notation [.json]). Input file types highly 


depend on the used module, they do not have to be similar. 


When using these modules it is not straightforward to align models and data structures. 
The language Julia is also new (appeared in 2012) and not so broadly used, so that it is 
not as easy to find information, tutorials and examples in comparison to more widely used 


languages. 


2.3.4 PySP: Pyomo Stochastic Programming 

The last revisited project is Pyomo Stochastic Programming (PySP) (Watson et al. 2012). 
PySP is part of the standard Pyomo package and is a Pyomo modeling extension used 
to solve stochastic programming optimization problems. These problems are optimization 
problems with uncertainty, mostly computed for projecting into the future. Either different 
scenarios or different nodes in network problems are modeled and given a stochasticity, so 


a probability of a tree branch in addition to the deterministic base model. 
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2.4 Our Approach 

We build on past work to develop new analyses and assessments that advance the literature 
and practice of interdependent infrastructure analysis. Our goal is to create a framework 
to be able to model dependencies and interdependencies in a standard form to reuse the 


models, when combining them with other models. For reaching this goal, we will: 


1. Develop a Python-based framework for linking two network flow models together. 
2. Develop a toy network for two small infrastructure systems to demonstrate methods. 
3. Implement or reuse previously studied, realistic networks to validate methods. 

4. Test our framework with a model of a third infrastructure system that was not intended 


for interdependent infrastructure analysis. 


Itis very important that this framework is able to perform analysis with network optimization 


models using Pyomo. 
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CHAPTER 3: 
Interdependent Infrastructure Model 





In this chapter, we develop a framework for modeling interdependent infrastructure systems. 
We present methods from the literature for interdependent network flow optimization and 
relate their formulation to critical infrastructure systems. However, past methods assume 
full knowledge of system interdependencies prior to model development and provide limited 
guidance for combining models developed without prior knowledge of interdependencies. 
We expand on these methods to create a generic approach to combine infrastructure network 
flow models. These generic methods support the analysis of infrastructure networks created 
without prior knowledge of interdependencies and support extensible and applied analyses, 
such as the effect of directional dependencies (one system depends on the other, but not 
vice versa) or the inclusion of non-optimization models (e.g., simulation models). This new 


approach also supports well-established methods for network vulnerability assessment. 


3.1 Interdependent Network Flow Models for Critical In- 


frastructure Systems 
Our interdependent infrastructure methods are based on the work of Enayaty Ahangar et al. 
(2020) for interdependent multi-layered network flow (IMN) modeling and analysis. This 
model formulation is generic for any network flow system and is based on the interdependent 
layer network (ILN) problem first formulated by Lee II et al. (2007). We relate this generic 
approach to critical infrastructure systems by identifying dependencies that occur in real 


networks and relating them to model primitives. 


3.1.1 IMN Model Formulation 
The following formulation is reproduced from Enayaty Ahangar et al. (2020): 


Indices and Sets 
K the set of layers 
N* the set of nodes in layer k ¢ K 


a1 


AK 


G* = (NF, A*) 


the set of arcs in layer k € K 


the directed network representing layer k € K 


Parameters [units] 


k 
ij 
k 
ij 
k 
f; 


kk’ 
d; 


Uu 


Cc 


the flow capacity on arc (i, 7) € A* 

the cost per unit flow of commodity k € K onarc (i, j) € A* 
the reward when node i € N* is operable in layer k € K 

(k # k’): the required consumption of commodity k € K 

at node i € N‘ M N* for node i to be operable in 

network layer k’ € K; 

(k =k’): the supply (if dé" < 0) or demand (if d**’ > 0) 

of commodity k € K at node i ¢ N* 


Decision Variables [units] 


k 
Xij 


yf 


Formulation 


S.t. 


the flow on arc (i, j) € A* 
whether (1) or not (0) node i € N* is operable in layer k € K 


max) tk Yeboah 


keK jeNk keK (i, j)eAk 


xi- xfs -di* - yf’ Vk, ke K, vie NF ONE 
(i,j)eA* (j,i Ak 
xh < uf, -y! Vk € K,V(i, j) € A* 
x, Suh yk Vk € K,V(i, j) € AX 
ys € {0, 1} Vk € K,Vi € N* 
xk 50 Vk € K,V(i, j) € AX 


iyo 
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(3.1) 


(3.2) 


(3.3) 
(3.4) 
(3.5) 
(3.6) 


Discussion 

The basis of this model is a network object consisting of nodes (N*), arcs (A*), and their 
directed relationships (G*). In addition to standard network models, this multi-layer model 
includes layers (K), where each layer or combination of layers can represent an infrastructure 


system. 


Network flow is governed by optimization to maximize the reward io for ensuring system 
elements are operable while subtracting transportation costs cae for each usage of an arc 
constrained by capacity u he The supply or demand of a node, as well as the interdependence 
are controlled by the parameter aie. Decision variables are ba for the flow on an arc and 


the binary variable ye for the operability of a node. 


With Constraint (3.2) the supply or demand of a node is included in the model. The arc 
capacity and the operability, controlled by the interdependent node is controlled by con- 
straints (3.3) and (3.4). And at the end the non-negativity constraint for arc flow (constraint 


3.6) and the operability of a node (binary constraint 3.5) is included in the model. 


This very basic formulation enables an optimization model for lots of different types of 


infrastructures and can be used as a basis for more complex models. 


3.1.2 Modeling Infrastructure Dependencies 
Lee II et al. (2007), Dixon (2011), and Enayaty Ahangar et al. (2020) identified ways to 
relate the IMN model to infrastructure dependencies: 


¢ Input dependence: When one infrastructure depends on the commodity of another 
infrastructure, for example a water pump needs electricity to operate. Here, the IMN 
model would include d t *’ from layer k representing electricity to layer k’ representing 
water. When enough electricity is delivered from the electric power network to the 


water network, y* "= | and the water system node is operational. 
Y; y p 


Mutual dependence: Multiple infrastructures are dependent on each other, for exam- 
ple a fuel network needs electric energy to work and an electric power network needs 
fuel to produce electric power. These dependencies can be implemented similarly to 
input dependence. 
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¢ Shared dependence: Multiple infrastructures are dependent on one node or arc in an 
infrastructure, for example a water pump and an intersection are powered by the same 
node of an electric power network. These dependencies can be represented similar to 


input dependence as d ie are independent for each combination of layers k and k’. 


Exclusive-or dependence: This dependence only allows one of multiple dependent 
nodes to work, for example a railroad crossing, where either a train can cross or vehi- 
cles can cross. These dependencies can be implemented by constraining combinations 


of binary variables ae 


Co-located dependence: Components of multiple infrastructures in the same geo- 
graphical region are either working or not depending on shared failures, for example 
an electric power substation and a subway stations are not usable due to flooding of 
a co-located region. These dependencies can also be implemented by constraining 


combinations of binary variables Ts 


While these dependencies capture many critical infrastructure relationships, streamlining 
their implementation for interdependent analysis requires greater consideration of infras- 
tructure model structure. The representation of infrastructure interdependencies depends on 
the physical relationships among systems and their representative model primitives. Real 
infrastructure models represent different assets as arcs and nodes depending on the services 
they provide. The failure of a node or arc in one network may have direct effects on the 
functioning of dependent systems and network effects and can impact interdependent oper- 
ations. To relate real system to IMN dependencies, we list several examples of node and arc 
dependencies in Table 3.1 and the different effects of their failures. 
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Table 3.1. Critical Infrastructure Network Dependencies. 


Infrastructure Model Elements & Effects 











Arc Are 
Pipe breaks > Road flooded 
Powerline falls > Road blocked 
Node Are 
Power demand unsatisfied — Water pump shut down 
Power demand unsatisfied —> Fuel pump shut down 
Node Node 
Power demand unsatisfied — Intersection jammed 


Fuel demand unsatisfied —>» Power generator shut down 





Arc Node 
Road jammed — Telecom repair impossible 
Telecom broken — Power substation shut down 











Infrastructure node and arc relationships are important to consider because they help guide 
the development of more extensible model formulations than those found in the literature. 
As shown in Table 3.1, choice of infrastructure model elements and their failure effects 
influence how to connect two infrastructure models together. For example, power demand 
(represented as a node in a electric power flow model) can impact the operations of arcs (if 
they represent pumps in water and fuel systems) or nodes (if they represent intersections in 
transportation systems). 


However, linking models together for interdependent analysis is possible with multiple 
implementations. For example a water pump can be modeled with a arc-on-node dependency 
as shown in the table, such that when a power demand node receives sufficient electric power, 
the water pump arc is able to move water. Another possibility would be to model it as a 
node-on-node dependency, so that multiple pumps (condensed into a node representing a 
pumping station) are all powered by the same electric power demand node and are only 
working if the needed demand is met. Depending on the scale of models and analysis, its 


possible to need both implementations. 
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3.2 Generic Structure of a Combined Model 
The goal of this work is to develop a method to model dependencies and interdependencies 


in a simple, adaptive way that enables a modeler to use either standalone or interdependent 
models for analysis. Whereas the IMN model formulation supports interdependent analysis, 
constructing and solving an IMN problem often assumes knowledge of model objectives 
and interdependencies prior to model build and solve. Yet, many infrastructure models are 
constructed as independent, standalone models, and interdependencies are only considered 
after initial model construction. With these pre-built models, interdependencies cannot be 


modeled freely and it may be difficult to link systems together. 


Instead, we build on the IMN formulation and use a more extensible approach utilizing 
the object oriented nature of Pyomo optimization models (Hart et al. 2017) in the Python 
programming language (Python Software Foundation 2001). Figure 3.1 presents the goal 
of our approach with fuel and electric power networks as a motivating example. similar 
to the IMN mode, past interdependent operator models assume perfect knowledge about 
networks and dependencies during model development, where all model elements are 
inherited from pre-existing problem formulations (see Figure 2.5), In contrast, we can use 
the object-oriented nature of Pyomo to add and change model elements for dependencies 
to pre-existing models by modifying existing objectives and adding indices, parameters, 
variables, and constraints. For the purposes of this work, we call these new dependent and 


interdependent models combo-models. 


The key difference with this approach is that neither the fuel model nor electric power model 
in Figure 3.1 need to comprise predefined dependencies to form an interdependent operator 
model. In other words, dependencies and interdependencies are not inherited from pre- 
existing models, but added in when forming the combo-model. This approach allows a user 
to take infrastructure models created for a single system in Pyomo (e.g., an electric power 
network) and connect it to other standalone models (e.g., a fuel network). Each standalone 
model becomes a sub-model object where constraints for interdependencies are added and 


the joint objective function of both infrastructure systems are solved simultaneously. 
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Figure 3.1. New Approach to Create Interdependent Operator Models. Pre- 
vious approaches to create interdependent operator models relied on inherit- 
ing model elements from pre-existing model formulations (see Figure 2.5). In 
contrast, we present a new way to form interdependent operator models that 
does not inherit dependency constraints from pre-existing models, but rather 
adds them in based on user input. The result is not requiring predefined in- 
frastructure dependencies prior to model creation and analysis. This small 
change in approach has meaningful implications for interdependent operator 
model development and analysis. 


3.2.1 Generic Combo-Model Formulation 

We introduce notation for linking two models together to create a formulation for combo- 
models. First, we assume that there are two standalone Pyomo model objects representing 
infrastructure network flow problems — modell and model2. We construct dependencies 


in a single direction at a time, such that there is a dependent model (DM) depending on 
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the function of another serving model (SM) providing a commodity for the DM to function 
(e.g., if modell depends on model2, model] is the DM and model? is the SM). 


To link Pyomo model objects together for interdependent analysis, first we define new sets, 


parameters, and decision variables that control dependencies. 


Indices and Sets 
DepE CG?” dependent elements of network DM needing commodity from SM 


ServE ¢ GS” serving elements of network SM delivering commodities to DM 


Parameters 
Threshga commodity threshold in DM to be met for d € DepE to function 


Decision Variables 
Tq 1 if d € DepE is functional, 0 otherwise [binary] 


Discussion 


We define four new model elements when creating dependencies. First, a new set of network 
elements of the DM which are dependent on a commodity flow from the SM denoted by 
the subset DepE. Similarly, we define a subset of network elements of the SM that provide 
commodity services to the DM as the subset ServE. Both subsets can be either nodes or 
arcs, depending on the element-effects relationships between the DM and SM (e.g., those 
in Table 3.1). Threshg defines a functional threshold for the dependency model element 
d € DepE requires of the flow commodity from the SM to be operational. The binary 
decision variable Tz acts as a switch to set the dependent model element d as working or 


not working based on the function of the SM. 


These model elements relate to the IMN model, but have key differences that enable more 
extensible implementations and interdependent solves. Threshg and the binary variable 
Tq serves a similar role to ake and iP in an IMN, respectively. However, in the IMN 
formulation, ae defines both flow demands and commodity requirements for a node to 
function in a DM (alias k). In contrast, the functional threshold Threshg can be a different 


value than flow requirements, such as when a minimum flow is required for an infrastructure 
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asset to operate (e.g., the electricity to turn a pump on), but total demand for operation may 
be higher (e.g., the final pump electricity requirements are greater). This approach supports 
linking more realistic infrastructure models for assessing operations during disasters, such 
as flow models with the objective of minimizing load shed rather than maximizing asset 


use and minimizing flow costs. 


Moreover, DepE and ServE are any subset of nodes or arcs defined after a DM and SM 
model are constructed. While flow restrictions due to functional interdependencies on nodes 
and arcs can be included in the IMN formulation, this would require node splitting strategies 
or the addition of intermediate flow networks k” for node-node and arc-arc dependencies. 
The use of subsets from existing models simplifies the overall implementation and enables 


easy model construction and solves. 


With these additional model elements, we define a new interdependent combo-model using 


two existing Pyomo model objects. 


Formulation 


DecVar[model||+[model2] On medal i OF [model2] (3.7) 


s.t. Constraints[model\| & Constraints |model2] 
Threshg-Ta < 


Dy Yao 


(k,s)€ArcssM 


_ by Yosm) Vd € DepE,s € ServE (3.8) 
(s,ym)€ArcsSM 

O= XP" 2 Cap Vd € DepE (3.9) 

Ta € {0, 1} Vd € DepE (3.10) 
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Discussion 


We use the object-oriented nature of Pyomo optimization models to combine infrastructure 
networks together. Some elements from modell and model2 are retained the combo-model. 
The objectives of both standalone models are combined by adding them if they have both the 
same optimization sense (minimizing or maximizing) or by subtracting them if they have 
different optimization senses. All constraints from the original models are also retained. 
This multiobjective formulation uses implicit weighting of 1 for each objective (i.e., flow 
costs in each network are assumed to be equal and independent). This can be changed by 
setting weights for each objective function or using a different multiobjective relationship 


(e.g., division). 


Several constraints are added to the combo-model for interdependent analysis. First, (3.8) 
is used to decide if there is enough commodity at element s to switch Ty to 1, allowing 
d to be operable. The needed threshold for this is set by parameter Threshg. The control 
of component d in the DM is constrained by (3.9), where X i; M is either a flow decision 
variable if d is an arc or a demand decision variable setting the produced or consumed 
commodity amount at a node. Ca pe M is the associated maximum capacity of this network 


element. With constraint (3.10), Tz is defined as a binary variable. 


3.2.2 Combo-Model Implementation in Python 

The combo-model formulation is enabled by the object oriented nature of the Python 
programming language and Pyomo optimization languages. In general, creating anew model 
with sub-models and interdependencies is complicated, lots of factors for each dependency 
need to be considered. Our generic combo-model structure simplifies and generalizes this 
process by a pre-defined structure. We implement this approach in Python to demonstrate 
its flexibility and standardize a framework for modeling interdependencies, using Pyomo 
for this task for the following reasons: 


¢ Pyomo is an optimization-modeling language, widely used for optimization models 
(Hart et al. 2017); 

¢ Pyomo and Python are open source, very good suitable for rapid prototyping and can 
be learned very fast; 


¢ Pyomo allows flexible use of optimization solvers. 
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We used the commercial solver CPLEX (IBM Corporation 2019) by IBM for our computa- 
tions because of its good performance. 


3.2.3. Combo-Model Generator Function 

Pyomo optimization models are often formulated once and then used multiple times with 
different input data to compare different model configurations. We implement a user-friendly 
combo-model generator function, that is used as a script to simplify the generation of a 
combo-model object file from two present Pyomo models. The resulting combo-model 
object file is then used to load this combined model in Pyomo for the analysis. An example 


use of the combo-model generator function is shown in Figure 3.2. 


COMBO-MODEL-GENERATOR 


Name for generated file (.py): modell on model2.py 


Hettt 

How many dependencies? (1-4): 1 

HHTTT 

Dependency 1: 

Directions: modell(2) depends on model2(1) --> lon2 (2on1) 


Enter the direction of the dependency: lon2 

Types: node-on-node: nn / node-on-arc: na / arc-on-node: an / arc-on-arc: aa 
Enter the type of the dependency: an 

Flow variable and arcs of model2: 

Var of model2: 

a, Ty 

Enter the flow variable of model2: x 

Set of model2: 

{"K", "n*, "A's 'G'] 

Enter the arc set where the flow is on of model2: A 

Dependent element (generating node / flow variable of arc) and capacity of modell: 
Var of modell: 

[*x", 'y'] 

Enter the dependent generating node / flow variable of modell: x 

Param of modell: 

Pe. ee ee oe "a" 

Enter the dependent node/arcs capacity of modell: Lu 

HtttE 


Figure 3.2. Combo-Model Generator Function. Given two Pyomo models as 
function inputs, the combo-model generator asks a user simple questions 
to generate an interdependent network flow model. User input is underlined 


in red. In this figure, we assume model elements are from the IMN and 
combo-model formulations. 
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The combo-model generator function is called from the command line or within a script 
and takes two network flow models as inputs. Then, the function prompts several areas for 
modeler input as shown in red in Figure 3.2. First, the user names a python script (.py) 
filename for saving the model to a file. The user then designates which model is the DM 
and SM via dependency direction (e.g., modell dependent on model2 is written as 1on2). 
The user then decides which types of model elements are dependent on each other (e.g., 
an means arcs dependent on nodes). The user then chooses the flow variables and sets for 
defining ServE, followed by the similar prompts for defining Dep£E. For each step, the 
function shows the user the appropriate data-structure to choose from and prevents typos. 


The combo-model generator function produces a (.py) file with a built-function for a Pyomo 
combo-model object and the correct number of arguments to populate with interdependency 
data. To conduct interdependent infrastructure analysis, a user must import this new model 
object and populate with data to explicitly define DepE, ServE, and Threshg. Interdepen- 
dency data is input as edge list in a Pandas DataFrame (The Pandas Development Team 
2020), where the dependent node is used as the index. 


3.3. Interdependent Network Vulnerability Analysis 

In this work, the purpose of constructing interdependent network flow problems is to assess 
system function and vulnerabilities. Where network flow optimization yields a steady-state 
snapshot the operations of an infrastructure, a more interesting question is measuring how 


vulnerable the system is with respect infrastructure disruptions and failures. 


3.3.1 Worst-Case Vulnerability assessment of a Single Network 

Alderson et al. (2014) proposes interdiction models as a bi-level or tri-level optimization 
problem for identifying the worst-case failures in an infrastructure system. An overview of 
the different available approaches is shown in Figure 3.3. The structure of modeling this 
problem is to define the failure events and to incorporate them into the model. Afterwards the 
attacker model is formulated to maximize the cost of a minimal cost network flow problem 
with the available attack budget x € X (starting at the bottom of Figure 3.3 going up to 
the left). This analysis finds the worst-case failures that increasing the cost of infrastructure 


operations much as possible. 
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Figure 3.3. Path of Assessing and Improving Operational Resilience. Either 
from a top-down or bottom-up view, using different optimization techniques: 
deterministic mathematical programs (left) or stochastic models (right). 
Source: Alderson et al. (2014). 


The next step from an infrastructure operators’ point of view is to strengthen the infrastruc- 
ture and mitigate failures with a limited budget. This is the third layer optimization with 
choosing the best design w € W to minimize the maximum possible cost by attacks. This 
approach is the suggested bottom-up approach by Alderson et al. (2014), where the consid- 
ered infrastructure system is being modeled at the component level and the functioning of 


the system depends on all components and how they work together. 


In comparison to this approach, it is possible to take a top-down view (starting at the top of 
Figure 3.3) and have the objective to minimize cost by improving the operational resilience 
function h(w) by choosing a design w. But there are difficulties with this approach. Choice 
of units for h(w) measured and presenting the different designs w? is difficult. 


Both approaches, top-down and bottom-up, can also be applied, when having the case of 


non-deliberate events, that are causing parts of the system to fail. Stochasticity can be used 
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for different events and expected value of the cost optimized. Another alternative could be, 


to run a simulation model, which has to be compatible with optimization techniques. 


3.3.2 Vulnerability of Interdependent Infrastructure Systems as Combo- 
Models 
The combo-model formulation and implementation in Pyomo supports similar analysis 
to those defined by Alderson et al. (2014). A combo-model has a combined objective 
representing the functioning of multiple infrastructure systems. Here, the same methods 
apply, as the choice of binary variables or stochastic losses for worst-case failures across 
multiple systems can be from the same or separate sets. In contrast, the final operations of 
both systems is dictated by two networks with interdependent flows, such that the results 


for a worst-case interdiction can change. 


For example, the choice of two arcs (i.e., attacker budget = 2) that cause a worst-case 
interdiction in a single network may be entirely different for interdependent system. In the 
interdependent setting, if the original network is a DM, worst-case interdictions may identify 
arcs in the SM that decrease network function even more. If both systems are dependent on 
each other, worst-case interdictions can be found that attack both networks. One important 
avenue of research is testing the effects of these interdependencies and comparing them to 


previous understandings of network vulnerabilities. 


3.4 Analysis 


We conduct a series of analyses for interdependent infrastructure systems to demonstrate 
the efficacy and capabilities of the combo-model formulation and generator function. First, 
we analyze the function of interdependent fuel and electric power system models that were 
previously studied in the literature with other model formulations. We implement the models 
as a combo-model to show that similarities in results with the added benefit of not needing 


to define interdependencies in initial model construction. 


Then, we use the combo-model formulation and function to easily develop new interde- 
pendent infrastructure models and assess their function and vulnerability. Specifically, we 
implement a transportation model developed by Good (2019) and Routley (2020) that de- 


termines traffic flows and travel times for communities on islands to access critical supplies. 
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This model was used by Routley (2020) to assess transportation on the island of St. Thomas, 
and not created for interdependent analysis. We connect the St. Thomas model to a fuel 
and electric power system model using our combo-model approach to assess the effects of 
electric power system and fuel network failures on the routing of people to access critical 
supplies. 
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CHAPTER 4: 
Interdependent Energy Networks 





We analyze interdependent energy networks to demonstrate the combo-model approach. We 
present network flow optimization models for a fuel network, an electric power network, and 
their interdependencies. We demonstrate the use of the combo-model method to construct 
and analyze a small interdependent system with three nodes in each network. We further 
demonstrate this approach with a larger interdependent fuel and electric power networks 
previously studied in Dixon (2011), Dickenson (2014), Ruether (2015), and Alderson et al. 
(2015). Due to the significant analysis already completed with these models, we only present 
new results developed using methods in this thesis. We refer the reader to these past studies 


for additional discussion of network data and analysis. 


4.1 Combo-Model Applied to Energy Networks 

Previous network flow models for interdependent fuel and electric power systems were 
formulated with interdependencies known in initial model construction (Dickenson 2014; 
Ruether 2015). In contrast, we reformulated standalone network flow models for each 
system, based on the already constructed models, then use the combo-model approach to 
link models together. In this section, we present each standalone model and the resulting 


interdependent formulation using our combo-model generator function. 


4.1.1 Fuel Network Model 
We adapt a fuel network from Dickenson (2014), Ruether (2015), and Alderson et al. (2015) 


with modification. 


Indices and Sets 
FN nodes 
FArcs C FNX FN arcs 


Parameters [units] 
FSupply; fuel supply(+) or demand(-) at node i € FN [bbl] 
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FLdSCost; load shed cost for not fulfilled demand at node i € F'N [$/bbl] 


FArcCost(,;) fuel arc cost on arc (i, j) € FArcs [$/bbl] 

FArcCap i,j) fuel capacity on arc (i, 7) € FArcs [bbl] 

FArcX,;,j) 1 if fuel arc (i, 7) € FArcs damaged, 0 otherwise [binary] 
FArcPenCost;;,;) damaged arc penalty cost [$/bbl] 


Decision Variables [units] 


FY(,;) fuel flow on arc (i, 7) € FArcs [bbl] 
FLdsS; load shed (not fulfilled demand) at node i € FN [bbl] 
Formulation 
Pras 7 FArcCost(i.;) tL G3) + 
(i,j)€F Arcs 
)) FLdSCost;:FLdSj+ )\ — FArcPenCost(,j) « FAreX¢,jp)* FY) (4.1) 
icFN (i,j)€F Arcs 
s.t. »  F¥iny- >) Fen — FLdSn < FSupply,n € FN (4.2) 
(n,j)€F Arcs (i,n)eF Arcs 
0 < FY(,;) < FArcCap(,;) V(i, J) € FAres (4.3) 
FLdS;=0_ if FSupply; => 0 Vie FN (4.4) 
0 < FLdS; < —FSupply; if FSupply; < 0 Vie FN (4.5) 
Discussion 


The model consists of nodes FN and arcs F'Arcs defining the fuel network. The network 


consists of supply and demand nodes defined by the parameter F Supply. The decision 


variables define the flow of fuel over each arc (F'Y(;,;)) and the load unserved at demand 


nodes (FLdS;). The objective (4.1) to minimize the cost of delivering fuel and penalty 


costs for not meeting demands. Constraint (4.2) defines the flow balance constraints with 


constraint (4.3) setting the upper and lower bounds on fuel flow over any network arc. 
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Constraints (4.4) and (4.5) determine unserved demand and penalty costs. Many of the 
physical properties of real fuel systems (e.g., pressure, transients, etc.) are ignored in this 
model to keep it as simple as possible while capturing key system function of fuel delivery. 


To penalize not fulfilling demand at a node in parts or completely, the decision variable 
F LdS; measures the amount of demand shed and the associated parameter FLdSCost; as- 
signs a penalty cost for each barrel not fulfilled. Moreover, the parameter F ArcPenCost(;,;) 


adds an additional penalty cost for each barrel of fuel transported on a broken arc. 


4.1.2 Electric Power Network Model 
We link our fuel network to an electric power network to study energy interdependencies. 
We use a Direct Current Optimal Power Flow (DCOPF) model developed for electric power 


transmission systems adapted from Dickenson (2014) and Ruether (2015) with modification. 


Indices and Sets 
PN 

PNG © PN 

PND C PN 

PNB C PN 

PArcs € PN xX PN 
PEdges © PNX PN 


Parameters [units] 
PGenCap; 
PGenCost; 
PDem; 

PLdSCost; 


PArcCapii,;) 
PArcRes(;,j) 
PArcReaq.;) 


nodes 
generator nodes 
demand nodes 
bus nodes 

arcs 


undirected edges 


power generator capacity at node i ¢€ PNG [MW] 
power generator cost at node i € PNG [$/MW] 
power demand at node i € PND [MW] 

load shed cost for not fulfilled demand 

at node i € PND [$/MW] 

power arc capacity on are (i, 7) € PArcs [MW] 
power arc resistance on arc (7, 7) € PArcs [Q] 


power arc reactance on arc (i,j) € PArcs [Q] 
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Calculated Parameters [units] 


PArcSus(;j.; power arc susceptance on arc (i, 7) € PArcs [Q] 
Gj) 
PArcRea(i,j) 


PArcSus (i,j) = PArcRea(i,j)2+PArcRes(i,})- 


Decision Variables [units] 


PY(i.,;) power flow on arc (i, 7) € PArcs [MW] 
6; phase angle at node i €¢ PN 
PGen; power generation at node i € PNG [MW] 
PLdS§; load shed (not fulfilled demand) at node i € PND [MW] 
Formulation 
py pining >) PGenCost; + PGenj+ )\ PLdSCost;- PLAS; (4.6) 
‘ : i¢PNG iePND 
st. PY (ij) = PArcSus,;;) - (0; — 9) V(i,j) € PEdges (4.7) 
Sy PY(in) - >, PY(n,j) = 0 Vn € PNB (4.8) 
(i,n)€PArcs (n,j)ePArcs 
PGem+ > PYin- >, P¥iniy =0 Vn € PNG (4.9) 
(i,n)€PArcs (n,j)EPArcs 
oe PY(i.n) — pS PY n,j) + PLdSn = PDem,n € PND (4.10) 
(i,n)€PArcs (n,j)ePArcs 
PY) — PY(;i) =0 V(i, j) € PEdges (4.11) 
PY(i,;) < PArcCap,,;) Vii, j) € PArcs (4.12) 
0 < PGen; < PGenCap; Vie PNG (4.13) 
0 < PLdS; < PDem; Vie PND (4.14) 
Discussion 


The electric power network consists of nodes (PN) and arcs (PArcs), where there are 
different types of nodes: Generator: PNG, Demand: PND, and Bus: PNB. Bus-nodes 
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span the network, where generator nodes produce electricity and demand nodes require 
electricity. To include the physical property of phase angles in an electric power network, 
edges PEdges are used as an undirected are (PArcs). 


The supply in the electric power network is modeled at generator nodes PNG, with a 
maximum capacity PGenCap; and an assigned cost for each generated megawatt (MW) 
(PGenCost;), where the cost is set to the cost of a megawatt-hour (MWh). The actual 
produced electric power by this generator node is the decision variable PGen;. On the 
other end of the power flow is the demand, which is set by parameter PDem;. Same as in 
the fuel network, unserved demand is considered as shed load, modeled by the decision 
variable PLdS; and the corresponding cost parameter PLdSCost; for each unit (MW) of 


not delivered. The capacity of each arc representing a power line is set by PArcCap(;,;). 


The physical properties of DCOPF are determined by the power line parameters resistance 
(PArcRes(;,;)) and reactance (PArcReay;,;)). These parameters are used to calculate power 


line susceptance (PArcSus(;,;)) with the following formula: 


PArcRea(i, j) 


FOL OOUS GS = a ee er D 
Gy) PArcRea(i, j/)* + PArcRes(i, j)* 


In addition to these three parameters, the decision variable 6; is used for the phase angle at 


a node to calculate the power balance in the network. 


The network flow optimization is controlled by minimizing the objective function (4.6), 
which is the sum of the power generation cost at the power generators and the penalty cost 
for shedding load (not fulfilling demand). Constraint (4.7) maintains the physical properties 
of the electric power grid and the flow in the network. Constraints (4.8), (4.9) and (4.10) 
keep the three types of nodes in balance and adjust the needed generation energy (PGen;) 
and the shed load (PLdS;). The constraint (4.11) is used to balance the two arcs, which are 
forming an edge. Constraint (4.12) is to keep the flow on an arc within its capacity limit and 
the last two constraints (4.13) and (4.14) are the non-negativity constraints for the decision 
variables (PGenCap;) and (PDem;). 


There is one key difference between the electric power model formulation presented here 
and and the models developed in Dickenson (2014) and Ruether (2015). Past work included 


variables, parameters, and constraints for interdependent fuel and electric power flows in the 
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model formulation. We remove these constraints since the combo-model approach develops 


them without the need of defining them in the initial model. The rest of the model is as is. 


4.1.3 Energy Combo-Model 

Fuel and electric power systems are interdependent on each other for network function. 
In this work, we consider two dependencies — one from the electric power system on 
fuel, and one from the fuel system on electricity. We model a dependency of the electric 
power network (i.e., DM) on the fuel network (i.e., SM) via the delivery of fuel through 
the fuel network generator nodes in the electric power network for power generation. This 
is a node-node dependency, where fuel commodities flow to nodes in the fuel network and 


serve generator nodes in the electric power network. 


Figure 4.1 shows the use of the combo-model generator function to easily create this 
node-node dependency with the models presented above as Pyomo model objects. The 
model of the fuel network is input to the function as model] and the model of the electric 
power network is model2. We use the combo-model generator function to create a one-way 
dependency model from electric power to fuel and save it to a file entitled power_on_fuel.py. 
Decision variables governing the delivery of fuel to electric power generators are FY which 
is defined for flow over arcs FArcs. The dependent nodes are a subset of PGen, where 
fuel delivery controls the capacity of generation PGenCap at a given node. The resulting 
file is a Pyomo model object with a built in method for populating these dependencies for 
testing different sets of interdependent electric power and fuel nodes and defining different 


functional thresholds for fuel delivery to allow generation. 
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COMBO-MODEL-GENERATOR 


Name for generated file (.py): power_on fuel.py 


#2222 

How many dependencies? (1-4): a 

#2222 

Dependency 1: 

Directions: modeli(2) depends on model2(i) --> lon2 (2o0n1) 


Enter the direction of the dependency: 2oni 

Types: node-on-node: nn / node-on-arc: na / arc-on-node: an / arc-on-arc: aa 
Enter the type of the dependency: nn 

Flow variable and arcs of modeli: 

Var of modell: 

['Fy', "FLds'] 

Enter the flow variable of modeli: Fy 

Set of modell: = 

['FN', "FArcs domain’, ‘FArcs'] 

Enter the arc set where the flow is on of modell: FArcs 

Dependent element (generating node / flow variable of arc) and capacity of model2: 
Var of model2: 

["PY', ‘theta’, "PGen', "PLdS'"] 

Enter the dependent generating node / flow variable of model2: PGen 

Param of model2: ——- 

["PGenCap', "PGenCost', "PDem', "PLdSCost', ‘PArcCap", ‘PArcRes', "PArcRea', "PArcSus"] 
Enter the dependent node/arcs capacity of model2: PGenCap 

$223 


Figure 4.1. Combo-Model Generator Function Applied to Energy Networks. 
The combo-model generator function presented in Ch. 3 is used to create an 
interdependent fuel and electric power network. Here, we are generating a 
combo-model object with a node-to-node dependency for an electric power 
generator that requires fuel to function. User-input is underlined in red. 


We also consider a dependency of the fuel network on electricity to operate pumps that 
enable the flow of fuel. This is an arc-node dependency, where power demand nodes supply 
electricity to fuel pumps modeled as arcs. This can be included as a second dependency 
when generating a combo model, very similar steps to those shown in Figure 4.1. This 
generates an interdependent infrastructure model where the function of fuel and electric 
power networks depend on each other and are solved simultaneously. 


The combo-model approach generates a network flow model that adds the following modi- 
fications and additions to the standalone fuel and electric power networks, which are very 
similar to these, used in Dickenson (2014) and Ruether (2015), only with generic names. 
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Indices and Sets 
PDFA CG FArcs 
FDPN C PNG 


Parameters [units] 
PThreshi;,;) 
PPNi,j) € PND 
FThresh; 

FPN; € FN 


Decision Variables [units] 
TFuel (i,j) 


T Power; 


Formulation 


min 
PY,PGen,PLdS,FY,F LdS 


(i,j)eF Arcs 


(i,j)eF Arcs 


electric power consuming fuel arc 


fuel consuming electric power node 


power needed at fuel arc (i, 7) € PDF A [MW] 
power providing node at fuel arc (i, 7) € PDFA 
fuel needed at power node i ¢ FDPN [bbl] 

fuel providing node at power node i ¢ FDPN 


1 if fuel transported by arc (i, 7) € PDF A, 
0 otherwise [binary] 
1 if electric power produced by node i ¢ FDPN, 


0 otherwise [binary] 


> PGenCost; » PGen; + » PLdSCost; - PLdS; + 
1iE¢PNG 


i¢PND 
F ArcCost(,j) - FY (i,j) +), FLdSCost; - FLdS; + 
icFN 
FArcPenCost(,;) > FArcX (i,j) > FY (i,j) 


(4.15) 
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st. (4.2), (4.3), (4.4), (4.5), (4.7), (4.8), 
(4.9), (4.10), (4.11), (4.12), (4.13), (4.14) 


PT hreshj;,;) T Fuel (;,;) < > PY(k,PPN«,;)) 
(k,PPN(i,;))€PArcs 
= > PY(ppny.pm) Vis f) €PDFA (4.16) 
(PPNu,j),m)ePArcs 
O< FY(.j) < FArcCapi.,j) : TFuel(;,;) V(i, J) €PDFA (4.17) 
T Fuel; € {0,1} V(i,j)€ PDFA (4.18) 


FThresh, -T Power, < > FY(.FPN,) 
(i,F PN,)€F Arcs 


Z > FY(ren,,;) Vn € FDPN (4.19) 

(FPN,,j)€F Arcs 
0 < PGen, < PGenCap,, -TPowery Vn € FDPN (4.20) 
TPower, € {0, 1} Vn € FDPN (4.21) 


Discussion 


This combo-model formulation combines elements from standalone fuel and electric power 
networks. All indices, sets, parameters, decision variables, and constraints are retained from 
both models. For the purposes of space, we do not reproduce these model elements in the 


combo-model formulation. 


The needed indices, sets, parameters, decision variables, and constraints for interdependent 
function are now added again in the combined model with the two sub-models. Sets for 
power generator nodes that depend on fuel (FD PN) and fuel arcs that depend on electricity 
(PD FA) are added to the model. The fuel required for electric power generators to work is 
the parameter FThresh;, where the serving fuel node provides fuel F PN;. Similarly, fuel 
arcs requiring electricity for pumping are assigned a parameter PThresh,;,;), with serving 
electric power demand nodes PPN(;,;). Both dependencies are modeled binary, so that 
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the dependent nodes are only working if the specific threshold of commodity is reached. 
While these are produced from standalone models and the combo-model generator function, 
they are identical to the model elements used by Dickenson (2014) and Ruether (2015) to 


consider energy network dependencies. 


The objective function for the combo-model is an unweighted, linear combination of the 
fuel network and electric power network objectives. The overall objective is to minimize 


both transportation cost of all commodities and any costs incurred for load shed. 


The first three constraints (4.16 - 4.18) model fuel arcs that depend on electricity, Constraint 
(4.16) set the decision variable TFuel(;,;) as a switch determining if PT hresh,;,;) is met 
by the PPN(;,;). Constraint (4.17) activates the fuel arc (i, j), if TFuel(,;) = 1 and (4.18) 
defines T Fuel; ;) to be binary. 


The next three constraints (4.19 - 4.21) model electric power generators dependent on fuel. 
Constraint (4.19) TPower; switches to 1 if FThresh; is met by the serving fuel node FPN; 
in the fuel network. Constraint (4.20) activates the power generating node if TPower; = 1 
and (4.21) defines T Power; to be binary. 


Overall, the combo-model formulation captures the key dependencies across both energy 
networks for interdependent analysis. The resulting model formulation has an objective 
and constraints that relate networks together such that their flows depend on their in- 
terdependent function. This approach has more flexibility for studying dependencies and 
interdependencies than others found in the literature by decoupling functional thresholds 
from flow demands. Importantly, prior knowledge of fuel and electric power dependencies 
is not required when constructing initial fuel and electric power networks. The simplicity of 


this approach lends itself to easily studying the function of multiple interdependent systems. 


4.2 Interdependent Energy Network Analysis 
We analyze the function and vulnerability of interdependent fuel and electric power net- 
works generated using the combo-model approach to demonstrate its use. We analyze two 


interdependent systems: 


1. A simple fuel and electric power network consisting of three nodes; and. 
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2. A realistic fuel and electric power network using data from Dickenson (2014) and 
Ruether (2015). 


Each analysis serves a different purpose. The first, simple analysis demonstrates the out- 
put of an interdependent energy network. The second, realistic analysis demonstrates that 
the combo-model formulation produces equivalent results to past studies. Together, these 
analyses demonstrate model output and validate the combo-model approach. 


4.2.1 Simple Fuel and Electric Power Networks 

We present a very simple interdependent energy network to demonstrate analysis. The 
simple interdependent model consists of a small fuel and electric power network. The 
simple fuel network consists of three nodes. Figure 4.2 visualizes the network and shows 


model output minimizing fuel delivery costs as a standalone system: 


¢ FNisup (blue): Supply node, can supply up to 200 bbl of fuel and is connected to 

FN2 (red). 

¢ FN2 (red): Demand node, has demand of 100 bbl of fuel and is connected to FN1 sup 

(blue) and FN3 (orange). 

¢ FN3 (orange): Demand node, has demand of 100 bbl of fuel and is connected to FN2 
(red). 
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FAB» — 2000 —-Q — 1000 9) 


Figure 4.2. Simple Fuel Network. FNisup (blue) is a supply node with ca- 
pacity 200 Barrel (bbl), FN2 (red) and FN3 (orange) are demand nodes, 
each with a demand of 100 bbl. Flow over fuel arcs travels from FN1Sup to 
FN2 to FN3. This is the minimum cost flow for this network as a standalone 
system. 


The simple electric power network consists of 4 nodes. Figure 4.3 visualizes the network 


and shows model output minimizing electric power delivery costs as a standalone system: 


¢ 2 power generators (blue): gf1, a fuel fired power generator and gs1, a small turbine 
generator. They have each a capacity of 100 MW and have a different production cost 
assigned, where gf] is cheaper than gs1. Both are connected to the bus node il. 

¢ 1 bus node (green): Bus node il is connected to all three components. 

¢ 1 demand node (orange): Demand nod dnl has a power demand of 70 MW of 


electric power and is connected to il. 
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Figure 4.3. Simple Electric Power Network. The network has two generators, 
gfl (fuel powered) and gs1 (small generator), each able to generate 100 
MW of electric power (blue). Each generator has a different cost, where 
gsl produces cheaper electric power than gsl. Bus node il (green) connects 
generators to demand node dl (orange), which requires 70 MW of electric 
power. 


Interdependent Network Flow Analysis 

Both models are interdependent on each other. The simple fuel network depends on electric 
power to transport fuel from FN2 to FN3. This represents a pump on this arc (arc-node 
dependency), which is only working, if there is at least 60 MW available at dl. The simple 
electric power network is dependent on fuel from the fuel node FN3 to generate electricity 
at gfl (node-node dependency). The required threshold for it to work is 80 bbl. Thus, the 
minimum cost delivery of fuel and electric power for both systems remains the same to the 


standalone networks. Figures 4.2 and 4.3 show dependent elements in orange. 


We analyze the vulnerability of a single fuel arc failure on the interdependent function of 
each simple network. We assume that the pipe (arc) between FN2 and FN3 in the fuel 
network fails and cannot be used. The resulting flows in the fuel network are shown in 
Figure 4.4. The failure of this arc results in electric power generator gfl not being able to 
function. Instead, gs1, which is more expensive to use, has to fulfill electric power demand. 
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Resulting power flow is shown in Figure 4.5. 


Figure 4.4. Simple Fuel Network with Arc Failure and Interdependent Solve. 
Pipe (FN2, FN3) is assumed to be broken, so no flow possible. This restricts 
the function of power generators in the simple electric power network that 
require fuel to function. 


\Y 
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Figure 4.5. Simple Electric Power Network with Fuel Arc Failure and Inter- 
dependent Solve. Fuel-powered generator gfl is dependent on fuel from FN3 
in the simple fuel network. Due to an arc failure in the fuel network gf1 is 
not able to produce electric power. Instead, gsl produces electric power at 
a higher cost to serve demand. 
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Tables 4.1 and 4.2 show the changes in network flow costs and effects of dropped demand 
caused by the interdependent failure. The broken fuel arc results in a higher objective value 
for both systems, where the combination of dropped demand and unserved nodes in the fuel 
network causes its objective to become 150 times greater. This is because each bbl of fuel 


costs 150, which results in the increase of this value by 15, 000. 


The electric power network objective only increases by 100% as increased costs are incurred 
for the new generation source but there is no dropped demand. However, this increase in 
cost could not be captured without the inclusion of networked interdependencies. Together, 
the interdependent vulnerability of both networks is measured using the combo-model 


approach. 


Table 4.1. Objective Values in Simple Interdependent Energy Network. 











Scenario Fuel Electric Power 
No Failure 100.02 700.00 
Fuel Arc Broken | 15,000.01 1,400.00 

















Table 4.2. Dropped Demand in Simple Interdependent Energy Network. 











Scenario Fuel | Electric Power 
No Failure 0 0 
Fuel Arc Broken | 100 0 

















4.2.2 Realistic Fuel and Electric Power Networks 
We analyze a larger fuel and electric power network to validate the combo-model approach 


against past studies. 


The realistic fuel network is a 16-node system first introduced in Dickenson (2014) and 
Ruether (2015) and studied in detail in Alderson et al. (2015). Figure 4.6 presents the 


supply and demand nodes, their networked structure via pipeline arcs for fuel delivery, and 
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the flows for solving the min cost fuel model using this network. The network consists of two 
supply nodes (blue) with each a capacity of 1350 bbl and 14 demand nodes (i.e., all red or 
orange nodes except FN10 and FN8). The demand nodes have each different demands and 
the orange nodes are the nodes, where elements of the electric power network are dependent 
on. All additional data for the fuel network, including fuel supply limits, arc capacities, flow 
costs, and demand requirements, are the same as the network presented in Dickenson (2014) 
andRuether (2015). We refer the reader to these previous studies for detailed information 


on network parameters. 


We also adapt a realistic electric power network from Dickenson (2014) and Ruether 
(2015). The electric power network is shown in Figure 4.7. It consists of 33 electric power 
generators of different types (fuel, nuclear, hydroelectric and coal) and for each type they 
have a different production cost. Electric power is delivered via a network of 24 bus nodes 
to 17 demand nodes, each with a different amount of demand. There are also 4 additional 
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bus nodes ending with the letter “p”, which are fake nodes to enable parallel power lines. 


Figure 4.7 also shows the results for solving the DCOPF model for this network as directed 
the flow of electricity over arcs. All additional data for the network model, including electric 
power supply limits, arc capacities, flow costs, and demand requirements, are the same as 
the network presented in Dickenson (2014) and Ruether (2015). We refer the reader to these 


previous studies for detailed information on network parameters. 
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Figure 4.6. Realistic Fuel Network. The fuel network connects supply nodes 
(blue), demand nodes (red and orange), and fictitious nodes for modeling 
parallel pipes (green) via pipes represented as arcs. Orange nodes indicate 
locations where the fuel network serves fuel to the realistic electric power 
network. The data for this network can be used to solve the min cost fuel 
problem with and without interdependencies. The results for solving this 
problem without interdependencies is shown on arcs in bbl. Network data 
and figure based on Ruether (2015). 
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Figure 4.7. Realistic Electric Power Network. The electric power network de- 
livers electricity from power generator nodes (blue) to demand nodes (red 
and orange) via intermediate bus nodes (green). Orange nodes indicate loca- 
tions where the electric power network serves electricity to the realistic fuel 
network. The data for the network supports solving a min cost DCOPF prob- 
lem with and without interdependencies. The results for solving this problem 
without interdependencies is shown on power lines in MW. Network data 
and figure based on Ruether (2015). 
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Interdependent Network Flow Analysis 

We use our combo-model approach to connect the realistic fuel and electric power networks 
for interdependent analysis. The fuel network serves electric power generators and electric 
power network serves fuel pumps. Interdependencies are located at orange nodes in Fig- 
ure 4.6 and Figure 4.7. During normal system function, network flows remain the same as 


in the standalone cases. 


We compare results from combo-model flows with past results from Ruether (2015). Ta- 
ble 4.3 shows the comparison of objective value results with past studies and the combo- 
model methods. As values are the same, we verify that the combo-model formulation and 


associate generator function produce acceptable results. 


Table 4.3. Comparison of Combo-Model Objective Value with Ruether 
(2015). He analyzed the interdependent function of both realistic energy 
networks and published results for their respective objective values. The 
combo-model and generator function approach produces identical results to 
previous studies verifying its use for interdependent infrastructure analysis. 





Results Fuel Electric Power 
Ruether (2015) | 4,460.26 84,900.80 
Combo-Model | 4,460.26 84,900.80 























We test the vulnerability of the interdependent system with a single power line arc failure 
between bus node i105 and df105. This node supplies electricity to pumps for fuel supply 
node FN10sup and the network. This loss of fuel supply causes load shed in the fuel 
network shutting down fuel driven electric power generators gf102c, gf102d, and gf115a- 
gf115e. This loss causes a re-balancing of the electric power network to adapt to the loss of 


production capacity. Resulting interdependent flows are shown in Figures 4.8 and 4.9. 
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Figure 4.8. Realistic Fuel Network with Arc Failure and Interdependent Solve. 
Power line (i105, df105) is assumed to be broken, shutting down pumps from 
FN10sup to the fuel network and leading to dropped demand across the 
network. Several orange nodes supplying fuel to the electric power network 
are unable to. 
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Figure 4.9. Realistic Electric Power Network with Arc Failure and Interde- 
pendent Solve. Power line (1105, df105) is assumed to broken, shutting down 
pumps from FN10sup to the fuel network and leading to dropped demand 
across the network. Several generators are unable to produce electricity due 
to loss of fuel. All demand remains served as lost fuel-powered generation is 
replaced with more expensive generators. 
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We compare the effects of interdependencies on network operations (Table 4.4 and 4.5). A 
single power line failure results in a significant portion of the fuel network losing access 
to fuel, including several demand nodes serving fuel to the electric power network. A total 
of 1,217.5 bbl of fuel becomes dropped demand and the resulting objective value for the 
network increases over 40 times. Still, the electric power network has enough capacity to 
fulfill the demand after losing access to 7 generators, leading to a minor increase in objective 
value and no dropped demand. Since the initial failure was in the electric power network, 
the dropped demand in the fuel network and increased generation costs and power dispatch 
are only captured due to interdependent analysis. 


Table 4.4. Objective Values in Realistic Interdependent Energy Network. 





Scenario Fuel Electric Power 
No Failure 4,460.26 84,900.80 
Power Arc Broken | 185,080.14 87,679.74 























Table 4.5. Dropped Demand in Realistic Interdependent Energy Network. 














Scenario Fuel | Electric Power 
No Failure 0 0 
Power Arc Broken | 1,217.5 0 














4.3 Summary 

Analysis of interdependent energy networks demonstrates the application of the approach 
of the combo-model generator function. We implement previously studied fuel and electric 
power networks and use the combo-model generator function to create an interdependent 
model. We test our approach using simple and realistic networks. Results validate the 
combo-model approach and show the importance of interdependent vulnerability analysis. 
In the next chapter, we expand this analysis to include network models never created for 


interdependent analysis. 
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CHAP TERS: 
Interdependent Energy and Transportation Networks 





In the previous chapter, we show that the combo-model methods are extensible to multiple 
energy models and networks. While the combo-model approach simplified model develop- 
ment, the realistic energy networks were already validated for interdependent analysis in 
past studies. In this chapter, we demonstrate the use of the combo-model approach for inter- 
dependent analysis with a network flow model not originally created for interdependency 
analysis. Specifically, we study dependencies and interdependencies across fuel, electric 


power, and transportation networks. 


5.1 Combo-Model Applied to Energy and Transportation 


Networks 

We study energy and transportation dependencies using network models from Ch. 4 and 
a transportation model developed by Good (2019) and Routley (2020). The transportation 
model measures the capacity of a transportation network to support access to critical 
supplies during a set curfew period. The purpose of the model is to determine the best 
routing for communities on an island to access disaster supplies given possible disruptions 
to the transportation network. The model is validated for use with data from the islands of 
St. Thomas, St. John, and St. Croix in the USVI. 


5.1.1. Transportation Network 

We adapt the roadway transportation and supply chain network developed by Good (2019) 
and Routley (2020) for interdependent infrastructure analysis. The formulation reproduced 
here is the same from Routley (2020). 


Indices and Sets 

ie N nodes (alias /, s, t) 
(i,j) € AGNXN arcs 

(s,t)€ DEGNXN set of all origin and destination pairs 
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reR 


Out; C A 
In; CA 


Data [units] 
Dst 


Uj; 
Sij 
dij 


avail; ; 


sections for piece-wise linear approximation 
(7 = total number of sections) 
set of all outbound arcs from node i 


set of all inbound arcs to node i 


supply rate at node s destined for node t 

(bs; < 0 represents demand) [vehicles per hour (VPH)] 
nominal capacity of arc (i, 7) [VPH] 

unrestricted speed of arc (i, 7) [miles per hour (MPH)] 
length of arc (i, 7) [miles] 

1 if arc (i, 7) is available for use, 0 otherwise 
maximum intended travel window for all 


origin-destination roundtrips [hours] 


Calculated Data [units] 


Aij 


hijr 


slope; j, 


intercept; ;, 


interval width on arc (i, 7) for calculating piecewise linear congestion 
aj 5 2U; j / r 


total travel time for all vehicles traversing segment r on arc (1, /) 
4 
dij rai 
he =A) (=) (1 +0.15 (4) | 
slope of segment r for arc (i, j) 
/ _ hijr—hijr- 
Ss OPe; jr _ ij 
y intercept of line section r for arc (i, 7) 


intercept; ine —slope; ite Aij) + Nijr-1 


Decision Variables [units] 


Ysti J 


Y; : 
Dropped ,, 


flow rate of supply originating at node s destined for node t 
transiting arc (i, 7) [VPH] 

total flow rate transiting arc (7, 7) [VPH] 

travel time on arc (i, 7) [vehicle hours] 

dropped quantity of supply originating at node s destined for 
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node t [vehicles] 


- Dropped,, (5.1) 


Vie N,(s,t)€ D,i=s (52) 
Vie N,(s,t)€ D,i=t (5.3) 


ViEN,(s,t) € D,i#s,i#t 


(5.4) 
V(s,t) ED, (i,j) EA (5.5) 
VG, jyEeA (5.6) 
Vi, j)EA (5.7) 
V(i, 7) € A, Wr ER (5.8) 
V(s,t) € D (5.9) 
V(s,t) € D (5.10) 


VG, 7) € A,(s,t) € D (5.11) 


EXceSS st excess quantity of demand originating at node s destined for 
node t [vehicles] 
Formulation 
ri ome Zt D 
Y,Z,Dropped,Excess (eA (sA)eD, st 
S.t. Ystij Ss, Ds Vsti + Dropped,, = Dst 
(i,j) €Out; (j,ieInj 
>» Vsti — >; Yor ji — Excesss = —bsy 
(i,j)€Out; (jen; 
Ysti J >, y, stji = =0 
(i,j) €Out; (j,i)eIn; 
Vsti J < Dst 
Yij = >» Ystij 
s,teD 
Yj; < 2uj;javail;; 
Zi; 2 intercept, ;, + slope; ,, - Yjj 
Excess; = ExcesSts 
Dropped,, = Dropped,, 
Ystij, Yij, Zij. Dropped, EXcess st > 0 
Discussion 


We provide a succinct description of this model for the purposes of interdependent analysis. 


For more details on the model formulation and use, we refer the reader to Good (2019) and 
Routley (2020). 


The transportation model consists of nodes N and arcs A, with multi-commodity flow on 
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arcs (i, j) originating from a source node s and traveling to a destination node t. The multi- 
commodity flows capture vehicles that travel from the same origins to different destinations 
(s, t) and their shared congestion on roads (i, 7) driven by a supply rate b,,. This formulation 
also takes into account travel due to a return trips, where any arriving vehicle traveling from 


s to t generates a return trip from f to s. 


The objective function (5.1) minimizes the vehicle-hours drivers spend on roads (Z;;). It 
identifies the best routes drivers should take for all (s, t) pairs simultaneously. The objective 
balances the travel time to and from an (s, ¢) pair with staying at home and not traveling at 


all. This balance is dictated by parameter g, which sets a maximum travel time window. 


Constraints (5.2) to (5.4) enforce balance of flow for all nodes, where decision variables 
Droppeds and Excess; determine total vehicles unable to travel to their intended desti- 
nation in the travel time window. Constraint (5.5) sets the supply-demand capacity for each 
route. The sum of the traffic density on one road arc is computed by constraint (5.6) and the 
maximum capacity of a road enforced by constraint (5.7). The minimal travel time on an arc 
is enforced by Constraint (5.8) and the symmetry of elastic variables is set by constraints 
(5.9) and (5.10). The non-negativity of all decision variables is enforced by Constraints 
(5.11). 


An important aspect of this model is that cycles are possible, where vehicles take routes 
that incur travel costs smaller than the objective gap. This is possible because short roads 
may incur very small values of Z;; when the number of vehicles on the road is far from 
the capacity u;;. Good (2019) introduced a cycle-breaking algorithm to remove any cycles 
post-optimization solve. Routley (2020) implements the same algorithm, which we also use 


here. 


5.1.2 Transportation and Energy Combo-Models 

We link the roadway transportation and supply chain model to fuel and electric power 
networks developed in Ch. 4. There are many dependencies that can be modeled between 
energy and transportation networks, including interdependent effects between roads, electric 
power lines, pipelines, locations of supply, locations of commodity use, and access to assets 
via the transportation network. We focus our analysis on the delivery of fuel and electricity 


to locations of commodity use within the roadway network with fictitious examples. 
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Fuel and Transportation Combo-Models (Gas Stations) 

The fuel network supplies fuel via pipeline to gas stations and fuel depots across the roadway 
transportation network. This dependency is a arc-node dependency affecting the fuel supply 
destinations in the roadway transportation network, where an inability to deliver fuel leads 
to the node and associated roads becoming unavailable and to the rerouting of vehicles to 
access fuel from other locations. Thus, this arc-node dependency involves the activation 
and deactivation of roadway links representing all entrances and exist from locations of fuel 


supply in the transportation model. 


Using the combo-model approach results with the following formulation. 


Indices and Sets 
FDTACA transportation arcs dependent on fuel 


Parameters [units] 
FThreshq,;) fuel needed at road arc (i, 7) € FDTA [bbl] 
FPNi,j) € FN fuel providing node at road arc (i, 7) € FDTA 


Decision Variables [units] 
TTrsp(,j) 1 if road are (i, 7) € FDTA available, 


0 otherwise [binary] 


Formulation 


FArcCost(,j) - FY(i,, +), FLdSCost; - FLAS; + 
(i,j)eF Arcs icFN 

FArcPenCost,;,;) - FArcX (i,j) + FY(i,j)+ 
(i,j)eF Arcs 


Py Zij + » + Droppedy, 


(i,j)EA (s,t)€D,s#t 


min 
FY,FLdS,Y,Z,Dropped,Excess 


(5.12) 


73 


s.t.(4.2) — (4.5), (5.2) — (5.11) 


FThreshq,j) -TTrspq.j) < Yi.,j) Vi, j) € FDTA (5.13) 
O< Y(i,;) <2 U(i,j) * TTrspii,j) V(i, J) € FDTA (5.14) 
TTrspiij) € {9, 1} Vii, J) € FDTA (5.15) 


Discussion 


The fuel-transport combo-model formulation follows the same form as our generic formu- 
lation (Section 4.1.3). It combines elements from standalone transport and fuel networks, 


which we do not repeat here for the purposes of space. 


The combo-model adds a set of transportation arcs dependent on fuel from the fuel model. 
These arcs are the on-ramp and off-ramp road arcs that drivers must take in the transportation 
model to access a gas station. The required amount of fuel at the gas station is FThreshi,;), 
where the serving fuel node FPN; ;) is provides fuel to the gas station. 


The objective function is an unweighted, linear combination of the transportation network 
and fuel network objectives. The combined objective is to minimize the transportation cost 
of the fuel, the vehicle hours on each arc and the dropped demand in the transportation 


model. 


Constraint (5.13) sets the decision variable T7rspi;,j) as a switch determining if 
FThresh@,;) is met by the FPN(;,;). Constraint (5.14) activates the transportation arc 
(i, j) to and from the gas station 7 if TTrsp,;,;) = 1. This constraint replaces constraint (5.7) 
in the original transportation model. Constraint (5.15) defines TTrsp,;,;) to be binary. The 
resulting model leads to rerouting of vehicles to other gas stations if the fuel network, the 


transportation model is dependent on, does not deliver enough fuel to node 7. 
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Electric Power and Transportation Combo-Models (Traffic Lights) 

The electric power network supplies electricity to traffic lights at major intersections in the 
roadway transportation network. This dependency is similar to the fuel dependency as a 
node-node connection. However, rather than affecting destinations, it affects transshipment 
nodes in the transportation network. Whereas loss of fuel at a gas station primarily leads to 
rerouting of vehicles traveling to gas stations, loss of electricity at an intersection leads to 


rerouting of all vehicles transiting the intersection for accessing all commodities. 


Using the combo-model approach results with the following formulation. 


Indices and Sets 
PDTACA transportation arcs dependent on electricity 


Parameters [units] 
PThreshy,j) power needed at road arc (i, 7) € PDTA [bbl] 
PPNG,j) € PND power providing node at road arc (i, 7) € PDTA 


Decision Variables [units] 
TTrspii,j) 1 if road arc (i, 7) € PDTA available, 


0 otherwise [binary] 


Formulation 


min )) PGenCost;-PGen;+ \ PLdSCost;- PLAS; + 
PY,PGen,PLdS,Y ,Z,Dropped,Excess 


icPNG iePND 
>; Zi; + >, - Dropped; 
(i,j)EA (s,t)€D,s#t 


(5.16) 
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s.t.(4.7) — (4.14), (5.2) — (5.11) 


PThreshy.j) -TTrspij) < Yj) Vis jf) € PDTA (5.17) 
O< Y(i,j) < Uci,j) ° TTrspii,j) V(i, J) € PDTA (5.18) 
TTrspiij) € {9, 1} V(i, j) € PDTA (5.19) 


Discussion 


The electricity-transport combo-model formulation is also based on our generic formulation 
(Section 4.1.3). It combines elements from standalone transportation and electric power 


networks, which we do not repeat here for the purposes of space. 


We add a subset of road arcs that connect to intersection dependent on electric power. 
The required amount of electricity is PThresh;;,;), where the serving power demand node 
PPN«,;) provides the electric power. 


The objective function is an unweighted, linear combination of the transportation network 
and electric power network objectives. The combined objective is to minimize the generation 
cost and the load shed penalty of the electric power, the vehicle hours on each arc and the 
dropped demand in the transportation model. 


Constraint (5.17) sets the decision variable T7Trspi;,j) as a switch determining if 
PThresh(,;) is met by the PPN,;,;). Constraint (5.18) activates the transportation arc 
(i,j) when TTrspq,;) = 1 and electricity is available. When electricity is not available at 
intersection i, all connected road arcs are assumed failed due to an accident and switched 
off. Constraint (5.19) defines T7rsp(;,;) to be binary. The resulting model leads to rerouting 
of vehicles based on electric power availability at intersections. 


Both energy-transportation combo-models models support interdependent infrastructure 


analysis. We demonstrate their use with simple and realistic networks. 
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5.2 Interdependent Energy and Transportation Network 
Analysis 

We analyze the function and vulnerability of interdependent energy and transportation 

networks using the combo-model approach. We use fuel and electricity networks developed 

in Ch. 4 and connect them to transportation networks developed by Routley (2020). We 


complete the following analyses: 


1. A simple transportation network from Routley (2020) dependent on the simple fuel 
network from Ch. 4; 

2. the simple transportation network from Routley (2020) dependent on the simple 
electric power network from Ch. 4; 

3. A realistic transportation network developed for the island of St. Thomas from Routley 
(2020) dependent on the realistic fuel network from Ch. 4; and, 

4. Arealistic transportation network developed for the island of St. Thomas from Routley 


(2020) dependent on the realistic electric power network from Ch. 4. 


5.2.1 Simple Energy and Transportation Networks 
We adapt the simple transportation network from Routley (2020, p. 29) for interdependent 


analysis. It consists of 13 nodes connected by roadway arcs: 


¢ 3 population nodes: Population nodes act as origins for trips to and from locations of 
supply (e.g., a grocery store). Each population node represents an entire community 
with a population of 2,000. Drivers at each population node demand fuel, grocery, or 
hardware commodities, dictating destinations. The number of cars and commodity 
requirements are calculated using values from Routley (2020) for St. John. 

¢ 1 grocery node: The grocery store acts as a destination and is connected by a separate 
arc to the 4-way crossing, marked with a dotted circle. 

¢ 1 hardware node: The hardware store acts as a destination and is connected by a 
separate arc to the 4-way crossing, marked with a dotted circle. 

¢ 1 fuel node: The gas station acts as a destination is connected by a separate arc to the 
4-way crossing, marked with a dotted circle. 

¢ 1 port node: The port acts as an origin for trips to resupply grocery stores, hardware 


stores, and gas stations. The port is in the south-west and is connected by a street (arc) 


ad 


to the 4-way crossing, marked with a dotted circle. 
¢ 6 transshipment nodes: These nodes connect roads together and act as intersections. 
The do not act as origins or destinations. 


Figure 5.1 shows the simple transportation network with the effects of a roadway disruption. 
The connection between the population node population001 and the 4-way intersection is 
assumed to be unavailable (e.g., due to flooding) and cannot be used. This effect only 
impacts driver routing as vehicles leaving from and returning to populationOO1 must drive 
through the center of the island to access food, gasoline, and hardware. We use this disrupted 
system for all interdependent analyses with simple networks. 


pulation003 


population002 


/ fuel001 
grocery001 
port001 hardware001 





Figure 5.1. Simple Transportation Network with a Disrupted Road. Rout- 
ley (2020) created a simple transportation model to demonstrate traffic 
and rerouting of vehicles with the roadway and supply chain transporta- 
tion model. The simple network is designed to simulate a portion of the 
island of St. John. It has one grocery store, one hardware store, and one 
gas station connected to a 4-way intersection (marked with a dotted circle). 
There are three population nodes and one port node that require access to 
these locations to access critical supplies and restock supplies, respectively. 
A failure of a road between population001 and the 4-way intersection leads 
to rerouting of cars through the center of the island. Figure adapted from 
Routley (2020, p. 29). 
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Simple Fuel and Transportation Networks (Gas Stations) 

We assess the dependency of gas stations in the simple transportation network (Figure 5.1) 
on the delivery of fuel via the simple fuel network (Figure 4.2). Here, we assume that the 
gas station node (fuel001) is supplied by a the simple fuel network at node FN3. If the fuel 
threshold at the supplying node FN3 is not met, then drivers that need gasoline will not 
travel. The flow in this network is modeled as an arc-node dependency and solved using the 


fuel-transportation combo-model formulation. 


Figure 5.2 displays routes drivers take with and without fuel network disruptions and the 
maximum travel times for drivers to acquire commodities are presented in Table 5.1. When 
there is no fuel network disruption, roads are near capacity due to drivers routing through 
the center of the network. Instead, when fuel arc (FN2, FN3) is disrupted and prevents fuel 
reaching FN3 (see Figure 4.4), the gas station is assumed to be unavailable and all drivers 


from the population centers do not travel. 


Table 5.1. Maximum Travel Times in Simple Fuel and Transportation Net- 
works [min]. 





Scenario Grocery | Fuel | Hardware 
No Failure 49.00 | 49.00 49.00 
Fuel Arc Broken | 29.32 N/A 29.32 
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Figure 5.2. Comparison of Traffic Density on Simple Transportation Network 
with Broken Fuel Arc. The top figure shows the traffic density (darker is 
higher) without any disruptions to the simple fuel network (see Figure 4.2). 
The bottom figure shows the traffic density with a disruption to the simple 
fuel network impacting the gas station fuel001 (see Figure 4.4). Due to the 
small size of the network, all driving routes remain the same. However, traffic 
density drops after a fuel pipeline disruption as drivers wanting to buy gas 
stay at home and become dropped demand. 


Tables 5.2 and 5.3 present model objective values and dropped demands in the simple fuel 
and transportation networks. While the effects of this fuel disruption leads to fewer cars on 
the road and shorter travel times for drivers traveling to the grocery and hardware stores, the 
negative effects of fuel network failures are captured via model objective values and dropped 
demand. Here, we see that the failure in the fuel network causes a significant increase in both 


fuel and transportation network objective values. The total combined objective becomes 11 
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times larger given a single arc disruption. This is due to significant dropped demand in both 
networks. Whereas no demand is dropped before the pipeline failure, both 100 bbl of fuel 
is undelivered and 1200 people cannot access needed fuel via the transportation network. 


Table 5.2. Objective Values in Simple Fuel and Transportation Networks. 





Scenario Fuel Transport 
No Failure 100.02 2,036.29 
Fuel Arc Broken | 15,000.01 | 7,847.23 























Table 5.3. Dropped Demand in Simple Fuel and Transportation Network. 





Scenario Fuel | Transport 
No Failure 0 0 
Fuel Arc Broken | 100 1,200 























Simple Electric Power and Transportation Networks (Traffic Lights) 

We assess the dependence of traffic lights in the simple transportation network (circled, 
Figure 5.1) on the delivery of electricity via the simple electric power network (Figure 
4.3). We assume the 4-way intersection in the simple transportation network is dependent 
on electric power from node d1 in the simple electric power network. We also assume 
that when traffic lights are not working for this intersection, that traffic can not pass the 
intersection (e.g., an accident occurs and the intersection becomes blocked). This is modeled 


as an arc-on-node dependency using the electric-transport combo-model formulation. 


We solve for the routes communities take with and without a power line failure. Figure 5.3 
shows the power line failure and Figure 5.4 shows the resulting traffic flows. Given a power 
line failure that prevents electricity from reaching node d1, the 4-way intersection in the 
simple transportation network becomes unavailable. Blocking this key intersection prevents 


drivers from reaching any commodities and all traffic becomes dropped demand. 
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Figure 5.3. Simple electric power network with power arc (i1, d1) failing. 
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Figure 5.4. Comparison of Traffic Density on Simple Network with Broken 
Electric Power Arc. The top figure shows the traffic density (darker is higher) 
without any disruptions in the simple power network. The bottom figure 
shows the traffic density with the broken power line (il, d1) (see Figure 5.3). 
Due to lost of traffic signals at intersections, critical supplies are blocked and 
all drivers in the simple network become dropped demand. 


This is supported by the resulting objective values and dropped demands for the dependent 
solve. Table 5.2 shows the objective values before and after the power line failure, where 
the objective value of both models increases by a factor of 7 or more. Table 5.5 shows 
the dropped demand for both models. There is a demand of 400 units of fuel, 400 units 
of grocery and 200 units of hardware at each population center. These and the 3 units of 


demand at the port sum up to 3,003 people unable to access supplies. 
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Table 5.4. Objective Values in Simple Electric Power and Transportation 
Networks. 





Scenario Electric Power | Transport 
No Failure 700.00 2,036.29 
Power Arc Broken 5,250.00 18,018.00 























Table 5.5. Dropped Demand in Simple Electric Power and Transportation 











Networks. 
Scenario Electric Power | Transport 
No Failure 0 0 
Power Arc Broken 70 3,003 

















Overall, results with these simple networks emphasize the importance of considering fuel 
and electric power dependencies in transportation networks. The loss of fuel commodities 
can lead to drivers rerouting to another gas station (if available), or staying home (if not). 
Similarly, the loss of traffic lights at key intersections can cause large disruptions by forcing 


drivers to take new routes or making multiple commodities unreachable. 


5.2.2 Realistic Energy and Transportation Networks 

We demonstrate the energy and transportation combo-models for realistic networks at the 
scale of a real island or military installation. We study a realistic roadway transportation 
and supply chain network representing roads, population centers, ports, and supply chain 
infrastructure on the island of St. Thomas in the USVI. 


The St. Thomas network was developed by Routley (2020) for analyzing the effects of 
flooding on community access to critical supplies (Figure 5.5). The island of St. Thomas 
has a population of roughly 50,000, with a hilly geography and numerous winding roads 
that lead to slow driving and significant traffic. In the network, there are 108 population 


centers, 1 port, 20 grocery stores, 6 hardware stores, and 14 gas stations. Solving a network 
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flow problem is necessary to determine if the existing road network has sufficient capacity 
for communities to access supplies and return home within a curfew period. The analysis by 
Routley (2020) shows the network does have sufficient capacity when all roads are available. 
However, during worst-case flooding, some communities may be isolated and unable tor 


reach gas stations, grocery stores, and hardware stores. 
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Figure 5.5. St. Thomas Transportation Network created by Routley (2020). 
Roads connected by intersections (yellow) allow population centers and ports 
(black) to access grocery stores, gas stations, and hardware stores (green, 
red, and blue). All data necessary to solve the roadway transportation and 
supply chain model is embedded in this network, including roadway capac- 
ities, maximum speeds, and population densities. We refer the reader to 
Routley (2020) for full network data and explanation. 


The St. Thomas network was not originally developed for interdependent infrastructure 
analysis. We use our combo-model framework to link this model to the realistic energy 
networks presented in Section 4.2.2. These dependencies are fictional as the realistic energy 
networks are not the true networks on St. Thomas. Still, they represent realistic dependencies 
that may affect the St. Thomas system. Thus, this analysis shows the efficacy of the combo- 


model framework and some realistic effects of failures at gas stations and intersections. 
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Realistic Fuel and St. Thomas Transportation Networks (Gas Stations) 

We assess the fictional dependency of gas stations on St. Thomas on the realistic fuel network 
from Section 4.2.2. We assume that the 14 gas stations in the St. Thomas transportation 
network correspond to the 14 demand nodes in the realistic fuel network. Assign each gas 
station node to a demand node in the fuel network. We also assume fuel network nodes are 
linked using pipelines that follow roads. The result is the realistic fuel network projected 
to the island of St. Thomas (Figure 5.6). The full list of fuel-transport dependencies are 
presented in the Appendix A.1. 





Figure 5.6. Realistic Fuel Network from Ruether (2015) Projected on 
St. Thomas. We relate the realistic fuel network from Ruether (2015) to 
the realistic transportation network by projecting it on to the island of 
St. Thomas. Red nodes represent supply and demand nodes. Network con- 
nectivity via pipelines are shown in black. Dependencies between networks 
are listed in Appendix A.1. 
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We analyze the effects of a worst-case interdiction of two pipelines in the realistic fuel 
network on the interdependent St. Thomas transportation network (Figure 5.7). Alderson 
et al. (2015) identify the two worst pipeline arcs to fail are (FN2, FN7) and (FN9, FN13). 
We implement this failure and solve the St. Thomas fuel-transport combo-model. Resulting 
flows in the realistic fuel network are shown in 5.7. The worst-case interdiction of two fuel 
arcs lead to an outage of 5 fuel demand nodes. 
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Figure 5.7. Realistic Fuel Model with Worst-Case 2 Broken Arcs. Fuel arcs 
(FN2, FN7) and (FN9, FN13) are broken and not usable by the model. Model 
by Alderson et al. (2015, p. 10). 


We show transportation network flows before and after fuel pipeline failures in Figure 5.8. 


Prior to fuel network failures, there are few vehicles traveling through the central portion 
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of island. After two pipelines fail in the fuel network, 5 gas stations on St. Thomas cannot 
receive fuel (marked with a cross). As fuel is unable to reach these locations, drivers on 
the eastern coast of the island must now cross the center of the transportation network to 
acquire fuel at the 9 other gas stations. This results in significantly more congestion in the 


central and southern portions of the island. 





Figure 5.8. Comparison of Traffic Density on St. Thomas with Two Broken 
Fuel Arcs. The top figure shows the traffic density (darker is higher) without 
fuel network failures. The bottom figure shows the five gas stations shutdown 
from fuel network failures and resulting traffic flows. 


We measure the impact on communities using the travel times, objective values, and dropped 
demands for each scenario. Table 5.6 presents the increased maximum travel time for drivers 
given the fuel network disruption. Before any failures in the fuel network, the maximum 
round-trip travel time for drivers is between 35-38 minutes. After the fuel disruption, 
maximum travel times to acquire all supplies increases. The additional congestion on 
roads makes drivers traveling to a grocery store or hardware store to take slightly longer. 
Importantly, time to acquire fuel more than doubles from 36 to 79 min. 
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scenarios and dropped demand This outage of 5 gas stations, which are also the 5 most 
eastern gas stations on the island leads to a higher traffic on the roads on the eastern part 
of the island, which can be seen very distinctly in Figure 5.8, where the base case with all 
gas stations working is displayed on the top part of the figure. On the bottom part is shown, 
how the traffic density is like, when the population in the east has to travel to the west to get 
gas. So the outage does not lead to a dropped demand, but it leads to increased traffic on 


the roads. 


Table 5.6. Maximum Travel Times in Realistic Fuel and St. Thomas Trans- 
portation Networks. 











Scenario Grocery | Fuel | Hardware 
No Failure 35.68 | 36.30 38.36 
Fuel Arc Broken | 35.96 | 79.28 39.81 




















Tables 5.7 and 5.8 present the objective values and dropped demand for realistic fuel- 
transport model before and after fuel network failures. The loss of pipelines leads to 512.6 
bbl of dropped demand in realistic fuel network, corresponding to an objective value increase 
of nearly 18 times. Increased congestion and dropped demand in the transportation network 
corresponds to the objective value increase 1.7 times. Together, these impacts mostly impact 


fuel access and roadway congestion in the eastern part of St. Thomas. 


Table 5.7. Objective Values in Realistic Fuel and St. Thomas Transportation 
Networks. 














Scenario Fuel Transport 
No Failure 4,460.26 | 2,229.50 
Fuel Arc Broken | 79,850.21 | 3,796.04 
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Table 5.8. Dropped Demand in Realistic Fuel and St. Thomas Transportation 
Networks. 











Scenario Fuel Transport 
No Failure 0 0 
Fuel Arc Broken | 512.5 5 

















Realistic Electric Power and St. Thomas Transportation Networks (Traffic Lights) 

We assess the fictional dependency of traffic lights on St. Thomas on the realistic electric 
power network from Section 4.2.2. We projected bus nodes from the realistic electric 
power model on to St. Thomas and connect busses by powerlines along roads. Then, we 
identified 35 intersections on the island of St. Thomas that have large traffic flows and traffic 
lights. We assume these intersections depend on electricity from nearby electric buses and 
associated demand nodes. The result is an electric power network projected to the island of 
St. Thomas, where the transportation network is dependent on (Figure 5.9). The full list of 


electric-transport dependencies are presented in the Appendix A.1. 


We assess the impacts of 3 simultaneous failures in the realistic electric power network on 
dependent electric-transport systems. We assume bus failures at d101, d102 and d107, which 
disconnect three demand nodes from the electric power network. The resulting impacts on 
electric power network operations are shown 5.10. In general, there are few changes in 


power flows as the loss of demand nodes only reduces generation and flow requirements. 


However, the loss of three electric power nodes has significant impacts on traffic in 
St. Thomas. Resulting interdependent traffic flows are shown in Figure 5.11. The three 
failed power nodes supply electricity to 19 intersections on a major road in the central 
portion of St. Thomas. This road traverses the capital city on St. Thomas (Charlotte Amalie) 
and connects the airport and city from west to east. As a result, we see increased traffic 
congestion around the deactivated intersections, through the northern portion of the island, 


and across the south east. 
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Figure 5.9. Realistic Electric Power Network from Ruether (2015) Projected 
on St. Thomas. We relate the realistic electric power network from Ruether 
(2015) to the realistic transportation network by projecting it on to the 
island of St. Thomas. Blue nodes represent buses within the electric power 
network. Black nodes represent intersections from the Routley (2020) model 
that require electricity. Dependencies are listed in Appendix A.1. 
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Figure 5.10. Realistic Electric Power Model with 3 Broken Arcs. Power De- 
mand Nodes d101, d102, and d107 are not usable by the model. 
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Figure 5.11. Comparison of Traffic Density on St. Thomas with Electric 
Power Outages. The top part shows the traffic density (darker is higher) 
without problems and the bottom part shows the traffic density with electric 
power outages on demand nodes d101, d102 and d107. The position of the 
affected intersections is marked. Model by Routley (2020). 


Table 5.9 shows the maximum travel times with and without the electric power failure. 
Results show that loss of traffic lights and failed intersections increases the travel time 
for communities to access grocery stores and hardware stores, but has a small effect on 
travel time to gas stations. This occurs because four of the grocery stores serving western 
St. Thomas are located near the airport, where power outages make them unreachable. As 
a result, western communities must cross the entire island to access food, with moderate 


increases in travel time for hardware for the same reason. 
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Table 5.9. Maximum Travel Times in Electric Power and St. Thomas Trans- 
portation Networks. 





Scenario Grocery | Fuel | Hardware 
No Failure 35.68 | 36.30 38.36 
Fuel Arc Broken | 77.46 | 35.06 46.70 


























The combined effects on electric power dependent transportation networks are measured 
in Tables 5.10 and 5.11. Results show moderate increases in the objective values due to 
limited dropped demand and increased travel times across the island. A greater number of 


people cannot reach their intended supplies by become stranded due to failed intersections. 


Table 5.10. Objective Values in Electric Power and St. Thomas Transporta- 
tion Networks. 





Scenario Electric Power | Transport 
No Failure 84,900.80 2,229.50 
Power Arcs Broken 97,817.00 3,041.23 























Table 5.11. Dropped Demand in Electric Power and St. Thomas Transporta- 
tion Networks. 











Scenario Electric Power | Transport 
No Failure 0 0 
Power Arcs Broken 330 58 

















5.3. Summary 
We demonstrate the extensibility of our combo-model framework by studying interde- 


pendent energy and transportation networks. We implement a roadway transportation and 
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supply chain model and study effects of energy network failures on traffic rerouting and 
access to critical supplies. The transportation model was not designed for interdependency 
analysis, but we easily generated fuel and electric power dependencies with our combo- 
model methods. We study fictitious networks to show the effects of fuel and electric power 


failures on simple and realistic transportation networks. 


95 


THIS PAGE INTENTIONALLY LEFT BLANK 


96 





CHAPTER 6: 


Conclusion 





The goal of this thesis was to develop a standard way to consider CIS interdependencies 
using optimization models. CIS rely on each other to function (e.g., electricity depends on 
water, and vice versa). Studying a single system in isolation may ignore key dependencies 
that influence vulnerabilities and cascade failures across systems. This concept of interde- 
pendencies is not new, and significant research has been completed that classify, model, 
and measure the effects of interdependencies on CIS function and vulnerabilities. However, 
upon review of this literature, we did not find any generic approach capable of connecting 
pre-existing CIS models for analysis. We built upon this literature, to create and implement 
a method to link infrastructure operator models together for interdependent analysis. The 
result is a mathematical and computational framework that easily combines CIS models 


and supports vulnerability analysis of their interdependent function. 


6.1 Generic Combo-Model, Validation, and Use 
We use the IMN model developed by Enayaty Ahangar et al. (2020) as a basis for our 


computational framework. Whereas an IMN model requires full knowledge of interdepen- 
dencies in model formulation, we deconstructed this approach and built on past studied by 
Dixon (2011), Alderson et al. (2015) and Ruether (2015) to link unrelated models together. 
We call these combined models combo-models. A combo-model enables interdependency 
analysis by combining two pre-built Pyomo network flow model objects, modifying their 
shared objectives, and adding subsets, parameters, decision variables, and constraints. The 
result is an interdependent network flow model that solves flows over multiple systems and 
incorporates their physical dependencies. We implement this straightforward approach in 
a combo-model generator function that works with any Pyomo network flow model via 


simple user input. 


We validate our combo-model generator function by measuring flows over well-studied 
systems. For this we used the fuel and electric power networks created by Dickenson 
(2014) and Ruether (2015). Previous implementations included interdependencies in model 


formulations. Our combo-model methods allows the fuel and electric power networks to be 
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pre-built without dependencies. Then, we add dependencies using our generator function. 
This approach is flexible to populate models with different data sets. We validate the 
resulting interdependent energy networks using simple and realistic networks. The simple 
energy combo-models validated that the effect of interdependencies on energy network 
vulnerability could be measured with our combo-model. We further validated results by 
recreating analyses previously complete by Ruether (2015) using a newly generated combo- 


model, built with the combo model generator function. 


We use our combo-model method to develop a new assessment of fictitious energy dependent 
transportation networks. We implement a roadway transportation and supply chain model 
from Good (2019) and Routley (2020). This model was pre-built in Pyomo and not created 
with interdependencies in mind. Using our combo-model generator function, we easily 


create fuel-transport and electricity-transport combo-models. 


We assess the vulnerability of simple and realistic transportation networks to dependent 
energy system failures. The results for simple energy-transportation combo-models validate 
our methods work and show the possible effects of fuel and electric power network failures on 
traffic and access to supplies. We further implement a realistic transportation network of the 
island of St. Thomas developed by Routley (2020) and create dependencies with our realistic 
fuel and electric power networks by projecting them onto the island. Although models are 
fictitious, vulnerability analysis with the St. Thomas network show the importance of 
using dependent or better interdependent network flow models for assessing transportation 
network vulnerability. Worst-case failures in in the fuel network also lead to significant 
rerouting of vehicles across the island of St. Thomas to access gas stations. Similarly, 
relatively small failures in the electric power network leads to significantly longer travel 


times to access food and hardware. 


It is important to emphasize that the transportation model by Good (2019) and Routley 
(2020) was not developed for interdependent infrastructure analysis. The combo-model 
method is both simple and straightforward to easily connect CIS models together, even if they 
currently do not consider dependencies or interdependencies. Moreover, previous analyses 
only looked at the impact of blocked or flooded roads on traffic rerouting. However, our 
combo-model method enables easy connection to our realistic energy networks to consider 


how fuel and electric power system failures also influence traffic. 
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6.2 Limitations and Future Work 


The results of this work suggest many promising possibilities for further research on inter- 
dependent CIS. The combo-model methods and generator function simplify the process of 
combining two unknown models together. One important avenue of research is combining 
more than two networks and solving these complicated problems to determine their inter- 
dependent function and vulnerabilities. For example, using models of this work, it would be 
possible to create a 3-network combo-model with fuel, electric power, and transportation 
dependencies united into a single analysis. This integrated assessment could include the 
effects of blocked roads on the function of fuel and electric power networks. Moreover, 
additional dependencies can be further considered, such as pipeline and powerline failures 
causing blocked roads. The more complicated these combinations get, the more nuanced the 
results when running a vulnerability analysis. This further enables comparison of vulnera- 
bility assessments and interdependent system assessments. Still, the combo-model methods 


are not tied to a specific model, such that future network flow models can also be considered. 


One limitation of this work is the combo-model generator function only works with network 
flow optimization models, but some CIS use simulation models to solve for their operations. 
An avenue for future research is to combine Pyomo optimization models with Python-based 
simulation models and consider their federated analysis. For example, Water Distribution 
Network (WDN) often use simulation or heuristic optimization techniques for determining 
water pressures and pump settings. This is because of the physical behavior of water 
with different pressure, depending on the usage of the whole network. There are Python 
implementations of these models, which could populate a Pyomo model object and be 
related to an optimization model solve. Connecting these systems requires considering of 
network time response and simulation behavior. Future work can consider using Pyomo 
model objects as an intermediary between optimization and simulation models to enable 


this federated analysis and assessment of interdependent vulnerabilities with WDNs. 


Another limitation of this work is we only modeled physical interdependencies. Future work 
should introduce more types of interdependencies, such as geographic, cyber, or logical. 
This should be possible with small modifications to the current methods to improve the 
usability with data like geographic coordinates. The user-interface could be modified to 
make it even more easy and comprehensible to use the generic combo model generator with 


these additional dependencies. 
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Overall, this work is limited, but shows that the combo-model methods and functions can 
enable many future analyses. This supports the protection and resilience of existing CIS to 
attacks or natural disaster and supports future planning of robust systems of CIS on islands 


and military installations. 
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APPENDIX: Data for Interdependencies 





A.1 Dependencies between Simple Networks 


A.1.1 Dependencies: Electric Power Network on Fuel 


Table A.1. Dependencies of Electric Power Network on Fuel (Simple Model). 
Node-node dependency. 





Dependent Node | Threshold | Providing Node 
gfl 80 FN3 




















A.1.2 Dependencies: Fuel Network on Electric Power 


Table A.2. Dependencies of Fuel Network on Electric Power (Simple Model). 
Arc-node dependency. 





Dependent Arc | Threshold | Providing Node 
(FN2, FN3) 60 dl 




















A.1.3. Dependencies: Transportation Network on Fuel (Gas Stations) 


Table A.3. Dependencies of Transportation Network on Fuel (Gas Stations) 
(Simple Model). Arc-node dependency. 





Dependent Arc | Threshold | Providing Node 
(tsn002, fuel001) | 80 FN3 
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A.1.4 Dependencies: Transportation Network on Electric Power (In- 
tersections) 


Table A.4. Dependencies of Transportation Network on Electric Power (In- 
tersections) (Simple Model). Arc-node dependency. 























Dependent Arc Threshold | Providing Node 
(tsn002, fuel001) 60 dl 
(tsn002, grocery001) | 60 dl 
(tsn002, hardware001) | 60 dl 
(tsn002, port001) 60 dl 
(tsn002, tsn001) 60 dl 
(tsn002, tsn003) 60 dl 
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A.2 Dependencies between Realistic Networks 


A.2.1 Dependencies: Electric Power Network on Fuel 


Table A.5. Dependencies of Electric Power Network on Fuel (Realistic 
Model). Node-node dependency. 





















































Dependent Node | Threshold | Providing Node 
gfl01c 285 FN15 
gfl01d 285 FN15 
gf102c 285 FN13 
gf102d 285 FN13 
gf107a 450 FN4 
gf107b 450 FN4 
gf107c 450 FN4 
gfll3a 535 FN16 
gf113b 535 FN16 
gfl13c 535 FN16 
gfll5a 112.5 FN1 
gfl15b 112.5 FN1 
gfl15c 112.5 FN1 
gfl15d 112.5 FN1 
gfll5e 112.5 FN1 
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A.2.2 Dependencies: Fuel Network on Electric Power 


Table A.6. Dependencies of Fuel Network on Electric Power (Realistic 
Model). Arc-node dependency. 



































Dependent Arc | Threshold | Providing Node 
(FN10, FN6) 180 df103 
(FN10, FN11) 180 df103 
(FN10, FN13) 71 df105 
(FN10sup, FN10) | 71 df105 
(FN8sup, FN8) 194 df114 
(FN8, FN4p) 194 df114 
(FN8, FN4) 100 df116 
(FN8, FN7) 100 df116 
(FN8, FN12) 100 df116 
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A.2.3. Dependencies: Transportation Network on Fuel (Gas Stations) 


Table A.7. Dependencies of Transportation Network on Fuel (Gas Stations) 
(Realistic Model). Arc-node dependency. 


















































Dependent Arc | Threshold | Providing Node 
(tsn116, fuel001) | 500 FN16 
(tsn125, fuel002) | 300 FN4 
(tsn194, fuel003) | 100 FN12 
(tsn195, fuel003) | 100 FN12 
(tsn206, fuel004) | 100 FN11 
(tsn226, fuel005) | 250 FN15 
(tsn234, fuel006) | 100 FN14 
(tsn377, fuel007) | 250 FN13 
(tsn433, fuel008) | 100 FN7 
(tsn437, fuel009) | 100 FN2 
(tsn438, fuel010) | 100 FN6 
(tsn551, fuel011) | 100 FN3 
(tsn572, fuel012) | 100 FN1 
(tsn622, fuel013) | 100 FN9 
(tsn672, fuel014) | 100 FN5 

















A.2.4 Dependencies: Transportation Network on Electric Power (In- 
tersections) 


Table A.8. Dependencies of Transportation Network on Electric Power (In- 
tersections) (Realistic Model). Arc-node dependency. 














Dependent Arc Threshold | Providing Node 
(tsn098, tsn109) 100 df114 
(tsn098, tsn099) 100 df114 
(tsn098, tsn092) 100 df114 
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(tsn122, tsn125) 100 d107 
(tsn122, tsn133) 100 d107 
(tsn122, tsn118) 100 d107 
(tsn125, tsn131) 100 d107 
(tsn125, tsn119) 100 d107 
(tsn125, tsn122) 100 d107 
(tsn125, fuel002) 100 d107 
(tsn125, grocery001) 100 d107 
(tsn143, tsn144) 100 d107 
(tsn143, tsn159) 100 d107 
(tsn143, tsn133) 100 d107 
(tsn143, tsn141) 100 d107 
(tsn144, tsn154) 100 d107 
(tsn144, tsn143) 100 d107 
(tsn144, tsn131) 100 d107 
(tsn144, tsn142) 100 d107 
(tsn159, tsn160) 100 d107 
(tsn159, tsn166) 100 d107 
(tsn159, tsn169) 100 d107 
(tsn159, tsn143) 100 d107 
(tsn159, grocery003) 100 d107 
(tsn160, tsn161) 100 d107 
(tsn160, tsn171) 100 d107 
(tsn160, tsn154) 100 d107 
(tsn160, tsn159) 100 d107 
(tsn169, tsn182) 100 d107 
(tsn169, tsn159) 100 d107 
(tsn169, grocery004) 100 d107 
(tsn171, tsn181) 100 d107 
(tsn171, tsn160) 100 d107 
(tsn205, tsn206) 100 d101 











106 





































































































(tsn205, tsn215) 100 d101 
(tsn205, tsn202) 100 d101 
(tsn205, tsn195) 100 d101 
(tsn206, tsn210) 100 d101 
(tsn206, tsn205) 100 d101 
(tsn206, fuel004) 100 d101 
(tsn206, population044) | 100 d101 
(tsn206, tsn193) 100 d101 
(tsn262, tsn263) 90 d102 
(tsn262, tsn281) 90 d102 
(tsn262, tsn258) 90 d102 
(tsn262, tsn236) 90 d102 
(tsn263, tsn277) 90 d102 
(tsn263, tsn262) 90 d102 
(tsn263, tsn237) 90 d102 
(tsn304, tsn319) 90 d102 
(tsn304, tsn293) 90 d102 
(tsn305, tsn318) 90 d102 
(tsn305, tsn294) 90 d102 
(tsn318, tsn325) 90 d102 
(tsn318, tsn305) 90 d102 
(tsn319, tsn321) 90 d102 
(tsn319, tsn325) 90 d102 
(tsn319, tsn304) 90 d102 
(tsn3 13, tsn317) 90 d102 
(tsn313, tsn311) 90 d102 
(tsn337, tsn352) 90 d102 
(tsn337, tsn340) 90 d102 
(tsn337, tsn333) 90 d102 
(tsn343, tsn347) 90 d102 
(tsn343, tsn351) 90 d102 
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(tsn343, tsn341) 90 d102 
(tsn389, tsn392) 100 d120 
(tsn389, tsn380) 100 d120 
(tsn392, tsn399) 100 d120 
(tsn392, tsn403) 100 d120 
(tsn392, tsn389) 100 d120 
(tsn392, tsn381) 100 d120 
(tsn399, tsn405) 100 d120 
(tsn399, tsn392) 100 d120 
(tsn423, tsn433) 100 d120 
(tsn423, tsn413) 100 d120 
(tsn423, grocery008) 100 d120 
(tsn423, tsn414) 100 d120 
(tsn402, tsn403) 100 df116 
(tsn402, tsn386) 100 df116 
(tsn403, tsn407) 100 df116 
(tsn403, tsn392) 100 df116 
(tsn403, tsn402) 100 df116 
(tsn457, tsn466) 100 df116 
(tsn457, tsn448) 100 df116 
(tsn457, tsn447) 100 df116 
(tsn457, hardware003) 100 df116 
(tsn553, tsn556) 100 d119 
(tsn553, tsn558) 100 d119 
(tsn553, grocery013) 100 d119 
(tsn553, tsn551) 100 d119 
(tsn593, tsn596) 100 d119 
(tsn593, tsn589) 100 d119 
(tsn596, tsn600) 100 d119 
(tsn596, tsn593) 100 d119 
(tsn613, tsn623) 100 d115 
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(tsn613, tsn621) 100 d115 
(tsn613, tsn612) 100 d115 
(tsn661, tsn667) 100 d115 
(tsn661, tsn663) 100 d115 
(tsn661, tsn656) 100 d115 
(tsn672, tsn674) 100 d115 
(tsn672, fuel014) 100 d115 
(tsn672, grocery020) 100 d115 
(tsn672, tsn670) 100 d115 
(tsn173, tsn174) 100 d110 
(tsn173, tsn168) 100 d110 
(tsn173, population035) | 100 d110 
(tsn174, tsn199) 100 d110 
(tsn174, tsn179) 100 d110 
(tsn174, tsn173) 100 d110 
(tsn174, tsn157) 100 d110 
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